diff --git a/scenarios/m01_first_contact/ink/m01_closing_debrief.ink b/scenarios/m01_first_contact/ink/m01_closing_debrief.ink
index eac83fb..3d718e6 100644
--- a/scenarios/m01_first_contact/ink/m01_closing_debrief.ink
+++ b/scenarios/m01_first_contact/ink/m01_closing_debrief.ink
@@ -20,6 +20,11 @@ VAR maya_identity_protected = true      // Did player protect Maya's identity
 VAR kevin_choice = ""             // warn, evidence, ignore
 VAR kevin_protected = false       // Did player help Kevin?
 
+// Security Audit Assessment
+VAR security_audit_completed = false    // Did player complete the security audit?
+VAR audit_correct_answers = 0           // Number of correct security assessments
+VAR audit_wrong_answers = 0             // Number of incorrect assessments
+
 // ================================================
 // START: DEBRIEF BEGINS
 // ================================================
@@ -193,7 +198,7 @@ Agent 0x99: Sometimes that's the right call. Fewer people involved means fewer p
 === kevin_frame_discussion ===
 {kevin_choice == "":
     // Player didn't encounter the frame-up files
-    -> derek_discussion
+    -> security_audit_review
 }
 {kevin_choice == "warn":
     -> kevin_warned
@@ -237,7 +242,7 @@ Agent 0x99: You disagreed. That matters.
 
 Agent 0x99: Not every agent would have taken the time. Not every agent would have cared.
 
--> derek_discussion
+-> security_audit_review
 
 === kevin_ignored ===
 Agent 0x99: Kevin Park was arrested this morning.
@@ -260,14 +265,85 @@ Agent 0x99: He's cleared now. But he's traumatized. His neighbors saw him taken
     Agent 0x99: Sometimes that's the right call. Sometimes the mission really does come first.
     Agent 0x99: But Kevin's going to need therapy. His kids are going to need therapy.
     Agent 0x99: Just... remember that. Next time you're weighing priorities.
-    -> derek_discussion
+    -> security_audit_review
 + [The mission had to come first]
     Agent 0x99: Did it? You still stopped Operation Shatter. You still caught Derek.
     Agent 0x99: Would five minutes to warn Kevin have changed that?
     Agent 0x99: I'm not judging. Field decisions are hard. But consequences are real.
     Agent 0x99: Kevin's kids watched him get arrested. That happened because of a choice you made.
     Agent 0x99: Live with it. Learn from it.
-    -> derek_discussion
+    -> security_audit_review
+
+// ================================================
+// SECURITY AUDIT REVIEW - Assess player's security analysis
+// ================================================
+
+=== security_audit_review ===
+{security_audit_completed:
+    -> audit_feedback
+}
+{not security_audit_completed:
+    -> no_audit_feedback
+}
+
+=== audit_feedback ===
+Agent 0x99: I noticed you gave Kevin a security assessment during your cover operation.
+
+{audit_correct_answers >= 4:
+    Agent 0x99: Your security analysis was excellent. You identified every major vulnerability correctly.
+    Agent 0x99: Physical access controls, Derek's suspicious access patterns, predictable passwords, Patricia's firing, and Derek's unjustified network segmentation.
+    Agent 0x99: That's professional-grade security consulting. Your cover was completely convincing.
+    + [I wanted to maintain my cover properly]
+        Agent 0x99: And you did. Kevin trusted you completely because you demonstrated real expertise.
+        Agent 0x99: That kind of authentic tradecraft makes all the difference in deep cover work.
+        -> derek_discussion
+    + [The vulnerabilities were pretty obvious once I looked]
+        Agent 0x99: Maybe to you. But recognizing them under pressure, while maintaining cover, while gathering intelligence on Operation Shatter?
+        Agent 0x99: That's good work. Don't undersell it.
+        -> derek_discussion
+}
+
+{audit_correct_answers == 3:
+    Agent 0x99: Your security analysis was solid. Three out of five correct assessments.
+    Agent 0x99: You identified most of the key vulnerabilities—enough to maintain credibility with Kevin.
+    Agent 0x99: A few blind spots, but nothing that compromised your cover or the mission.
+    + [Which ones did I miss?]
+        {audit_wrong_answers >= 1:
+            Agent 0x99: You underestimated a couple of the vulnerabilities Kevin had already flagged.
+            Agent 0x99: In the field, always trust when an insider is telling you something's wrong. They see the patterns we miss.
+        }
+        -> derek_discussion
+    + [I was focused on the bigger picture]
+        Agent 0x99: Fair enough. Your primary mission was Operation Shatter, not a comprehensive security audit.
+        Agent 0x99: Kevin bought your cover. That's what mattered.
+        -> derek_discussion
+}
+
+{audit_correct_answers <= 2:
+    Agent 0x99: Your security assessment was... rough. Two or fewer correct answers out of five.
+    Agent 0x99: Kevin was asking you about obvious vulnerabilities he'd already identified. You dismissed most of them.
+    + [I was trying not to alarm him]
+        Agent 0x99: Understandable. But when an insider is showing you red flags, validate their concerns.
+        Agent 0x99: You're supposed to be a security expert. Kevin needed you to see what he was seeing.
+        Agent 0x99: Fortunately, your other actions kept him cooperative. But that assessment almost blew your cover.
+        -> derek_discussion
+    + [Security assessment wasn't my priority]
+        Agent 0x99: It's part of your cover identity. When you're undercover as an expert, you need to be that expert.
+        Agent 0x99: Kevin noticed you were missing things he'd already flagged. That could have raised suspicions.
+        Agent 0x99: Mission succeeded anyway, but... work on your tradecraft. Deep cover requires authenticity.
+        -> derek_discussion
+}
+
+=== no_audit_feedback ===
+Agent 0x99: I noticed you didn't provide Kevin with a security assessment during your cover operation.
+
+Agent 0x99: That's fine—it wasn't required for the mission. But it could have strengthened your cover credibility.
+
+Agent 0x99: Next time you're undercover with a professional identity, look for opportunities to demonstrate authentic expertise.
+
+Agent 0x99: It builds trust. And trust gives you access.
+
+-> derek_discussion
 
 // ================================================
 // DEREK DISCUSSION - Based on how player handled confrontation
diff --git a/scenarios/m01_first_contact/ink/m01_closing_debrief.json b/scenarios/m01_first_contact/ink/m01_closing_debrief.json
index 8f5cb6c..b9a2490 100644
--- a/scenarios/m01_first_contact/ink/m01_closing_debrief.json
+++ b/scenarios/m01_first_contact/ink/m01_closing_debrief.json
@@ -1 +1 @@
-{"inkVersion":21,"root":[[["done",{"#n":"g-0"}],null],"done",{"start":[["#","^speaker:agent_0x99","/#","^Agent 0x99: ","ev",{"VAR?":"player_name"},"out","/ev","^, return to HQ for debrief.","\n","^Agent 0x99: Operation Shatter is neutralized. Let's review what happened.","\n","ev","str","^On my way","/str","/ev",{"*":".^.c-0","flg":4},{"c-0":["\n",{"->":"debrief_location"},null]}],null],"debrief_location":[["^[SAFETYNET HQ - Agent 0x99's Office]","\n","#","^speaker:agent_0x99","/#","^Agent 0x99: ","ev",{"VAR?":"player_name"},"out","/ev","^. First, I need you to understand what you accomplished today.","\n","^Agent 0x99: Those casualty projections—42 to 85 people. Diabetics. Elderly. People with anxiety disorders.","\n","^Agent 0x99: They're going to live. Because of you.","\n","ev","str","^That's what matters","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^It was close. Too close.","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n",{"->":"evidence_review"},null],"c-1":["\n",{"->":"close_call"},null]}],null],"close_call":["^Agent 0x99: 72 hours. That's how close we cut it.","\n","^Agent 0x99: If our AI hadn't flagged those data collection patterns, if you hadn't found the documentation...","\n","^Agent 0x99: But you did. And those people will never know how close they came.","\n",{"->":"evidence_review"},null],"evidence_review":["^Agent 0x99: Let's review what you recovered.","\n","ev",{"VAR?":"found_casualty_projections"},{"VAR?":"found_target_database"},"&&","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"evidence_complete"},{"->":".^.^.^.8"},null]}],"nop","\n","ev",{"VAR?":"found_casualty_projections"},{"VAR?":"found_target_database"},"!","&&","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"evidence_partial_projections"},{"->":".^.^.^.17"},null]}],"nop","\n","ev",{"VAR?":"found_casualty_projections"},"!",{"VAR?":"found_target_database"},"&&","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"evidence_partial_database"},{"->":".^.^.^.26"},null]}],"nop","\n","ev",{"VAR?":"found_casualty_projections"},"!",{"VAR?":"found_target_database"},"!","&&","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"evidence_minimal"},{"->":".^.^.^.36"},null]}],"nop","\n",null],"evidence_complete":[["^Agent 0x99: You found everything. The casualty projections. The target demographics database. The complete Operation Shatter documentation.","\n","^Agent 0x99: This is exactly what prosecutors need. Derek's signature on the death calculations. The Architect's approval. The targeting methodology.","\n","^Agent 0x99: Thorough work. You didn't rush past the evidence.","\n","ev","str","^I wanted to make sure we had enough to convict","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^The more I found, the worse it got","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","^Agent 0x99: You do. There's no walking away from this for Derek.","\n",{"->":"npc_interactions"},null],"c-1":["\n","^Agent 0x99: Yeah. Reading those casualty projections... that stays with you.","\n",{"->":"npc_interactions"},null]}],null],"evidence_partial_projections":["^Agent 0x99: You found the casualty projections—the smoking gun. Derek's death calculations, The Architect's approval.","\n","^Agent 0x99: We're missing the full target demographics database, but that's recoverable from their servers now that we have access.","\n","^Agent 0x99: The critical evidence is secured. That's what matters for prosecution.","\n",{"->":"npc_interactions"},null],"evidence_partial_database":["^Agent 0x99: You found the target demographics database—2.3 million people profiled for vulnerability.","\n","^Agent 0x99: We're still missing the casualty projections document, but the database alone proves intent. They were targeting vulnerable populations deliberately.","\n","^Agent 0x99: Our forensics team is recovering the rest from their systems.","\n",{"->":"npc_interactions"},null],"evidence_minimal":["^Agent 0x99: The core Operation Shatter documentation is still being recovered by our forensics team.","\n","^Agent 0x99: The operation is stopped, but we're relying on digital forensics for the prosecution evidence.","\n","^Agent 0x99: Next time, prioritize document recovery. Physical evidence is harder to deny in court.","\n",{"->":"npc_interactions"},null],"npc_interactions":["ev",{"VAR?":"talked_to_kevin"},{"VAR?":"talked_to_maya"},"&&","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"worked_with_both"},{"->":".^.^.^.6"},null]}],"nop","\n","ev",{"VAR?":"talked_to_kevin"},{"VAR?":"talked_to_maya"},"!","&&","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"worked_with_kevin"},{"->":".^.^.^.15"},null]}],"nop","\n","ev",{"VAR?":"talked_to_kevin"},"!",{"VAR?":"talked_to_maya"},"&&","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"worked_with_maya"},{"->":".^.^.^.24"},null]}],"nop","\n","ev",{"VAR?":"talked_to_kevin"},"!",{"VAR?":"talked_to_maya"},"!","&&","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"worked_alone"},{"->":".^.^.^.34"},null]}],"nop","\n",null],"worked_with_both":["^Agent 0x99: I noticed you worked with both Kevin and Maya.","\n","^Agent 0x99: Kevin gave you legitimate access—that's the IT contractor cover working as intended.","\n","ev",{"VAR?":"maya_identity_protected"},"/ev",[{"->":".^.b","c":true},{"b":["\n","^Agent 0x99: And Maya... you protected her identity. She's safe. She can continue her journalism without looking over her shoulder.","\n","^Agent 0x99: That matters. She took a risk contacting us.","\n",{"->":".^.^.^.9"},null]}],[{"->":".^.b"},{"b":["\n","^Agent 0x99: Maya's identity was compromised during the operation. We're relocating her for safety.","\n","^Agent 0x99: She'll be okay, but her career at Viral Dynamics is over. Collateral damage.","\n",{"->":".^.^.^.9"},null]}],"nop","\n",{"->":"kevin_frame_discussion"},null],"worked_with_kevin":["^Agent 0x99: Kevin's cooperation was valuable. The IT contractor cover worked perfectly.","\n","^Agent 0x99: You got legitimate access without raising suspicion. That's clean infiltration.","\n",{"->":"kevin_frame_discussion"},null],"worked_with_maya":["^Agent 0x99: Maya was taking a risk talking to you. I hope you appreciated that.","\n","ev",{"VAR?":"maya_identity_protected"},"/ev",[{"->":".^.b","c":true},{"b":["\n","^Agent 0x99: Her identity stayed protected. She can continue investigating on her own terms now.","\n",{"->":".^.^.^.7"},null]}],[{"->":".^.b"},{"b":["\n","^Agent 0x99: Unfortunately, her identity was compromised. We're handling her protection.","\n",{"->":".^.^.^.7"},null]}],"nop","\n",{"->":"kevin_frame_discussion"},null],"worked_alone":["^Agent 0x99: You handled this mostly solo. Independent approach.","\n","^Agent 0x99: Sometimes that's the right call. Fewer people involved means fewer potential leaks.","\n",{"->":"kevin_frame_discussion"},null],"kevin_frame_discussion":["ev",{"VAR?":"kevin_choice"},"str","^","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"derek_discussion"},{"->":".^.^.^.8"},null]}],"nop","\n","ev",{"VAR?":"kevin_choice"},"str","^warn","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"kevin_warned"},{"->":".^.^.^.18"},null]}],"nop","\n","ev",{"VAR?":"kevin_choice"},"str","^evidence","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"kevin_evidence"},{"->":".^.^.^.28"},null]}],"nop","\n","ev",{"VAR?":"kevin_choice"},"str","^ignore","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"kevin_ignored"},{"->":".^.^.^.38"},null]}],"nop","\n",null],"kevin_warned":[["^Agent 0x99: I saw in your report that you warned Kevin about the frame-up.","\n","^Agent 0x99: That was risky. If he'd panicked, if Derek had noticed...","\n","ev","str","^He deserved to know","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^I couldn't just let Derek destroy him","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","^Agent 0x99: He did. And now he's lawyered up, documented everything. When the prosecutors came for him, he was ready.","\n","^Agent 0x99: His career is intact. His life isn't ruined. Because you took five minutes to be decent.","\n",{"->":"kevin_outcome_positive"},null],"c-1":["\n","^Agent 0x99: You're right. Kevin didn't ask to be part of this. He helped you because he's a good person.","\n","^Agent 0x99: Derek would have fed him to the wolves. You didn't let that happen.","\n",{"->":"kevin_outcome_positive"},null]}],null],"kevin_evidence":["^Agent 0x99: The contingency files you left for investigators—that was smart.","\n","^Agent 0x99: When the follow-up team found them, they immediately flagged Kevin as a victim, not a suspect.","\n","^Agent 0x99: He never even knew he was in danger. Woke up, went to work, found out his company was a front for terrorists, and went home to his family.","\n","^Agent 0x99: Clean. Professional. And kind.","\n",{"->":"kevin_outcome_positive"},null],"kevin_outcome_positive":["^Agent 0x99: You know what Derek would have said? \"Kevin is acceptable collateral damage.\"","\n","^Agent 0x99: You disagreed. That matters.","\n","^Agent 0x99: Not every agent would have taken the time. Not every agent would have cared.","\n",{"->":"derek_discussion"},null],"kevin_ignored":[["^Agent 0x99: Kevin Park was arrested this morning.","\n","ev","str","^What?","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^The frame-up worked?","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n",{"->":"kevin_arrest_details"},null],"c-1":["\n",{"->":"kevin_arrest_details"},null]}],null],"kevin_arrest_details":[["^Agent 0x99: Derek's contingency plan activated automatically when Viral Dynamics' systems were seized. Fake logs, forged emails.","\n","^Agent 0x99: Kevin spent six hours in interrogation before our team figured out he was being framed.","\n","^Agent 0x99: He's cleared now. But he's traumatized. His neighbors saw him taken away in handcuffs. His kids watched.","\n","ev","str","^I... I saw the files. I knew.","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^The mission had to come first","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","^Agent 0x99: I know. It's in Derek's computer logs.","\n","^Agent 0x99: You made a choice. Focus on the mission. Let Kevin be collateral damage.","\n","^Agent 0x99: Sometimes that's the right call. Sometimes the mission really does come first.","\n","^Agent 0x99: But Kevin's going to need therapy. His kids are going to need therapy.","\n","^Agent 0x99: Just... remember that. Next time you're weighing priorities.","\n",{"->":"derek_discussion"},null],"c-1":["\n","^Agent 0x99: Did it? You still stopped Operation Shatter. You still caught Derek.","\n","^Agent 0x99: Would five minutes to warn Kevin have changed that?","\n","^Agent 0x99: I'm not judging. Field decisions are hard. But consequences are real.","\n","^Agent 0x99: Kevin's kids watched him get arrested. That happened because of a choice you made.","\n","^Agent 0x99: Live with it. Learn from it.","\n",{"->":"derek_discussion"},null]}],null],"derek_discussion":["^Agent 0x99: Now, about Derek Lawson...","\n","ev",{"VAR?":"final_choice"},"str","^arrest","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"consequence_arrest"},{"->":".^.^.^.10"},null]}],"nop","\n","ev",{"VAR?":"final_choice"},"str","^recruit","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"consequence_recruit"},{"->":".^.^.^.20"},null]}],"nop","\n","ev",{"VAR?":"final_choice"},"str","^expose","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"consequence_expose"},{"->":".^.^.^.30"},null]}],"nop","\n",{"->":"consequence_arrest"},null],"consequence_arrest":[["^Agent 0x99: You chose arrest. Legal prosecution through proper channels.","\n","^Agent 0x99: He's not cooperating—true believers rarely do. But we have the evidence. His signature on the casualty projections.","\n","^Agent 0x99: He'll spend decades in prison explaining why 85 dead people would have been \"educational.\"","\n","ev","str","^Will the charges stick?","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^He seemed so certain he was right","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","^Agent 0x99: Conspiracy to commit mass murder. Terrorism. Computer crimes.","\n","ev",{"VAR?":"found_casualty_projections"},"/ev",[{"->":".^.b","c":true},{"b":["\n","^Agent 0x99: With the casualty projections you recovered? He's done.","\n",{"->":".^.^.^.8"},null]}],[{"->":".^.b"},{"b":["\n","^Agent 0x99: We're building the evidence case. It'll take longer, but he's not walking free.","\n",{"->":".^.^.^.8"},null]}],"nop","\n",{"->":"phase_3_discussion"},null],"c-1":["\n","^Agent 0x99: That's what makes true believers dangerous. They've rationalized everything.","\n","^Agent 0x99: Derek doesn't think he's a murderer. He thinks he's an educator.","\n","^Agent 0x99: The jury will disagree.","\n",{"->":"phase_3_discussion"},null]}],null],"consequence_recruit":[["^Agent 0x99: You offered him a chance to cooperate. Turn informant.","\n","^Agent 0x99: I heard his answer. \"I will never betray ENTROPY.\"","\n","^Agent 0x99: True believers don't turn, ","ev",{"VAR?":"player_name"},"out","/ev","^. They'd rather go to prison as martyrs.","\n","ev","str","^I had to try","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^I thought maybe he'd want to reduce his sentence","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","^Agent 0x99: It was worth asking. His refusal tells us something about ENTROPY's organizational culture.","\n","^Agent 0x99: These aren't mercenaries. They're ideologues. That's useful intelligence.","\n",{"->":"recruit_outcome"},null],"c-1":["\n","^Agent 0x99: A rational person would. Derek isn't rational. He's a believer.","\n","^Agent 0x99: His ideology matters more than his freedom.","\n",{"->":"recruit_outcome"},null]}],null],"recruit_outcome":["^Agent 0x99: He's in custody now. Same outcome as arrest.","\n","^Agent 0x99: But we learned something important: ENTROPY attracts true believers. They won't flip for deals.","\n","^Agent 0x99: We'll need to find other ways to get inside intelligence.","\n",{"->":"phase_3_discussion"},null],"consequence_expose":[["^Agent 0x99: Public disclosure. Full transparency.","\n","^Agent 0x99: The casualty projections are on every news site. Derek's death calculations. The targeting lists.","\n","^Agent 0x99: The world now knows what ENTROPY was willing to do.","\n","ev","str","^People deserve to know","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^Let them see who Derek really is","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","^Agent 0x99: Maybe. But now ENTROPY knows we're onto Operation Shatter methodology.","\n","^Agent 0x99: They'll adapt. Change tactics. We've lost the element of surprise.","\n",{"->":"expose_outcome"},null],"c-1":["\n","^Agent 0x99: They're seeing. \"Acceptable losses.\" \"Educational deaths.\"","\n","^Agent 0x99: The public is horrified. Good. They should be.","\n",{"->":"expose_outcome"},null]}],null],"expose_outcome":["^Agent 0x99: Director Netherton is... not happy. We don't usually expose methods.","\n","^Agent 0x99: But ENTROPY's tactics are now public knowledge. People know to verify. To question.","\n","^Agent 0x99: In a twisted way, you taught the lesson Derek wanted—just without the deaths.","\n","ev",{"VAR?":"maya_identity_protected"},"/ev",[{"->":".^.b","c":true},{"b":["\n","^Agent 0x99: At least Maya's identity stayed protected through all this.","\n",{"->":".^.^.^.11"},null]}],[{"->":".^.b"},{"b":["\n","^Agent 0x99: Maya's identity came out in the disclosure. She's being handled as a public whistleblower now.","\n",{"->":".^.^.^.11"},null]}],"nop","\n",{"->":"phase_3_discussion"},null],"phase_3_discussion":[["^Agent 0x99: ","ev",{"VAR?":"player_name"},"out","/ev","^, I need you to understand what we learned today.","\n","^Agent 0x99: We always thought ENTROPY was sophisticated cybercrime. Data theft. Corporate espionage.","\n","^Agent 0x99: This is different. Derek had casualty projections. He calculated deaths and considered them acceptable.","\n","ev","str","^They're willing to kill for their ideology","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^What does that mean for future missions?","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n",{"->":"true_nature"},null],"c-1":["\n",{"->":"true_nature"},null]}],null],"true_nature":[["^Agent 0x99: It means we're not fighting criminals. We're fighting true believers.","\n","^Agent 0x99: People who think killing people is \"education.\" Who see deaths as \"acceptable losses.\"","\n","^Agent 0x99: And if Social Fabric was willing to do this... what are the other cells planning?","\n","ev","str","^Who is The Architect?","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^How do we stop them?","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n",{"->":"architect_mystery"},null],"c-1":["\n",{"->":"stop_entropy"},null]}],null],"architect_mystery":[["^Agent 0x99: We don't know. ENTROPY's leader, strategist, philosopher.","\n","^Agent 0x99: Derek quoted The Architect. Believed every word. Got approval to kill 85 people.","\n","^Agent 0x99: Whoever they are, they've built an organization of true believers.","\n","ev","str","^We have to find them","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^That sounds terrifying","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","^Agent 0x99: Every cell we disrupt, every operation we stop, brings us closer.","\n","ev",{"VAR?":"lore_collected"},3,">=","/ev",[{"->":".^.b","c":true},{"b":["\n","^Agent 0x99: The intelligence you collected today gives us new leads. The Architect's communication patterns. Their philosophical fingerprints.","\n",{"->":".^.^.^.9"},null]}],"nop","\n",{"->":"mission_end"},null],"c-1":["\n","^Agent 0x99: It is. But that's why SAFETYNET exists.","\n","^Agent 0x99: Today, you stood between ENTROPY and 85 people they'd sacrifice.","\n",{"->":"mission_end"},null]}],null],"stop_entropy":["^Agent 0x99: Cell by cell. Operation by operation.","\n","^Agent 0x99: Today you stopped Operation Shatter. Tomorrow, we stop the next one.","\n",{"->":"mission_end"},null],"mission_end":["^Agent 0x99: First mission complete. Lives saved. True believer in custody.","\n","ev",{"VAR?":"lore_collected"},3,">=","/ev",[{"->":".^.b","c":true},{"b":["\n","^Agent 0x99: And ","ev",{"VAR?":"lore_collected"},"out","/ev","^ intelligence fragments recovered. That's thorough investigative work.","\n",{"->":".^.^.^.8"},null]}],"nop","\n","ev",{"VAR?":"lore_collected"},0,"==","/ev",[{"->":".^.b","c":true},{"b":["\n","^Agent 0x99: You focused on the primary objectives. Efficient.","\n","^Agent 0x99: But next time, look for additional intelligence. Context helps future operations.","\n",{"->":".^.^.^.16"},null]}],"nop","\n","^Agent 0x99: Get some rest. Next briefing is in 48 hours.","\n","^Agent 0x99: And ","ev",{"VAR?":"player_name"},"out","/ev","^? You did more than complete a mission today.","\n","^Agent 0x99: You saved lives. Real people who will never know your name.","\n","^Agent 0x99: That's what SAFETYNET is for.","\n","^[MISSION COMPLETE: FIRST CONTACT]","\n","ev",{"VAR?":"final_choice"},"str","^arrest","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n","^[OUTCOME: Derek Lawson arrested - Prosecution pending]","\n",{"->":".^.^.^.41"},null]}],"nop","\n","ev",{"VAR?":"final_choice"},"str","^recruit","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n","^[OUTCOME: Derek Lawson arrested - Refused cooperation]","\n",{"->":".^.^.^.51"},null]}],"nop","\n","ev",{"VAR?":"final_choice"},"str","^expose","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n","^[OUTCOME: Full public disclosure - ENTROPY methods exposed]","\n",{"->":".^.^.^.61"},null]}],"nop","\n","^[OPERATION SHATTER: NEUTRALIZED]","\n","^[LIVES SAVED: 42-85 (estimated)]","\n","ev",{"VAR?":"found_casualty_projections"},{"VAR?":"found_target_database"},"&&","/ev",[{"->":".^.b","c":true},{"b":["\n","^[EVIDENCE: COMPLETE - All critical documents recovered]","\n",{"->":".^.^.^.73"},null]}],"nop","\n","ev",{"VAR?":"found_casualty_projections"},{"VAR?":"found_target_database"},"!","&&","/ev",[{"->":".^.b","c":true},{"b":["\n","^[EVIDENCE: SUBSTANTIAL - Casualty projections secured]","\n",{"->":".^.^.^.82"},null]}],"nop","\n","ev",{"VAR?":"found_casualty_projections"},"!",{"VAR?":"found_target_database"},"&&","/ev",[{"->":".^.b","c":true},{"b":["\n","^[EVIDENCE: SUBSTANTIAL - Target database secured]","\n",{"->":".^.^.^.91"},null]}],"nop","\n","ev",{"VAR?":"found_casualty_projections"},"!",{"VAR?":"found_target_database"},"!","&&","/ev",[{"->":".^.b","c":true},{"b":["\n","^[EVIDENCE: PARTIAL - Forensics team recovering additional files]","\n",{"->":".^.^.^.101"},null]}],"nop","\n","ev",{"VAR?":"maya_identity_protected"},"/ev",[{"->":".^.b","c":true},{"b":["\n","^[MAYA CHEN: Identity protected]","\n",{"->":".^.^.^.108"},null]}],[{"->":".^.b"},{"b":["\n","^[MAYA CHEN: Identity compromised - Under SAFETYNET protection]","\n",{"->":".^.^.^.108"},null]}],"nop","\n","ev",{"VAR?":"kevin_protected"},"/ev",[{"->":".^.b","c":true},{"b":["\n","^[KEVIN PARK: Protected from frame-up - Career intact]","\n",{"->":".^.^.^.114"},null]}],"nop","\n","ev",{"VAR?":"kevin_choice"},"str","^ignore","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n","^[KEVIN PARK: Arrested, later cleared - Traumatized but free]","\n",{"->":".^.^.^.124"},null]}],"nop","\n","ev",{"VAR?":"kevin_choice"},"str","^","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n","^[KEVIN PARK: Status unknown]","\n",{"->":".^.^.^.134"},null]}],"nop","\n","^[The Architect remains at large...]","\n","#","^exit_conversation","/#","end",null],"global decl":["ev","str","^Agent 0x00","/str",{"VAR=":"player_name"},"str","^","/str",{"VAR=":"final_choice"},0,{"VAR=":"objectives_completed"},0,{"VAR=":"lore_collected"},false,{"VAR=":"found_casualty_projections"},false,{"VAR=":"found_target_database"},false,{"VAR=":"talked_to_maya"},false,{"VAR=":"talked_to_kevin"},true,{"VAR=":"maya_identity_protected"},"str","^","/str",{"VAR=":"kevin_choice"},false,{"VAR=":"kevin_protected"},"/ev","end",null]}],"listDefs":{}}
\ No newline at end of file
+{"inkVersion":21,"root":[[["done",{"#n":"g-0"}],null],"done",{"start":[["#","^speaker:agent_0x99","/#","^Agent 0x99: ","ev",{"VAR?":"player_name"},"out","/ev","^, return to HQ for debrief.","\n","^Agent 0x99: Operation Shatter is neutralized. Let's review what happened.","\n","ev","str","^On my way","/str","/ev",{"*":".^.c-0","flg":4},{"c-0":["\n",{"->":"debrief_location"},null]}],null],"debrief_location":[["^[SAFETYNET HQ - Agent 0x99's Office]","\n","#","^speaker:agent_0x99","/#","^Agent 0x99: ","ev",{"VAR?":"player_name"},"out","/ev","^. First, I need you to understand what you accomplished today.","\n","^Agent 0x99: Those casualty projections—42 to 85 people. Diabetics. Elderly. People with anxiety disorders.","\n","^Agent 0x99: They're going to live. Because of you.","\n","ev","str","^That's what matters","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^It was close. Too close.","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n",{"->":"evidence_review"},null],"c-1":["\n",{"->":"close_call"},null]}],null],"close_call":["^Agent 0x99: 72 hours. That's how close we cut it.","\n","^Agent 0x99: If our AI hadn't flagged those data collection patterns, if you hadn't found the documentation...","\n","^Agent 0x99: But you did. And those people will never know how close they came.","\n",{"->":"evidence_review"},null],"evidence_review":["^Agent 0x99: Let's review what you recovered.","\n","ev",{"VAR?":"found_casualty_projections"},{"VAR?":"found_target_database"},"&&","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"evidence_complete"},{"->":".^.^.^.8"},null]}],"nop","\n","ev",{"VAR?":"found_casualty_projections"},{"VAR?":"found_target_database"},"!","&&","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"evidence_partial_projections"},{"->":".^.^.^.17"},null]}],"nop","\n","ev",{"VAR?":"found_casualty_projections"},"!",{"VAR?":"found_target_database"},"&&","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"evidence_partial_database"},{"->":".^.^.^.26"},null]}],"nop","\n","ev",{"VAR?":"found_casualty_projections"},"!",{"VAR?":"found_target_database"},"!","&&","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"evidence_minimal"},{"->":".^.^.^.36"},null]}],"nop","\n",null],"evidence_complete":[["^Agent 0x99: You found everything. The casualty projections. The target demographics database. The complete Operation Shatter documentation.","\n","^Agent 0x99: This is exactly what prosecutors need. Derek's signature on the death calculations. The Architect's approval. The targeting methodology.","\n","^Agent 0x99: Thorough work. You didn't rush past the evidence.","\n","ev","str","^I wanted to make sure we had enough to convict","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^The more I found, the worse it got","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","^Agent 0x99: You do. There's no walking away from this for Derek.","\n",{"->":"npc_interactions"},null],"c-1":["\n","^Agent 0x99: Yeah. Reading those casualty projections... that stays with you.","\n",{"->":"npc_interactions"},null]}],null],"evidence_partial_projections":["^Agent 0x99: You found the casualty projections—the smoking gun. Derek's death calculations, The Architect's approval.","\n","^Agent 0x99: We're missing the full target demographics database, but that's recoverable from their servers now that we have access.","\n","^Agent 0x99: The critical evidence is secured. That's what matters for prosecution.","\n",{"->":"npc_interactions"},null],"evidence_partial_database":["^Agent 0x99: You found the target demographics database—2.3 million people profiled for vulnerability.","\n","^Agent 0x99: We're still missing the casualty projections document, but the database alone proves intent. They were targeting vulnerable populations deliberately.","\n","^Agent 0x99: Our forensics team is recovering the rest from their systems.","\n",{"->":"npc_interactions"},null],"evidence_minimal":["^Agent 0x99: The core Operation Shatter documentation is still being recovered by our forensics team.","\n","^Agent 0x99: The operation is stopped, but we're relying on digital forensics for the prosecution evidence.","\n","^Agent 0x99: Next time, prioritize document recovery. Physical evidence is harder to deny in court.","\n",{"->":"npc_interactions"},null],"npc_interactions":["ev",{"VAR?":"talked_to_kevin"},{"VAR?":"talked_to_maya"},"&&","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"worked_with_both"},{"->":".^.^.^.6"},null]}],"nop","\n","ev",{"VAR?":"talked_to_kevin"},{"VAR?":"talked_to_maya"},"!","&&","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"worked_with_kevin"},{"->":".^.^.^.15"},null]}],"nop","\n","ev",{"VAR?":"talked_to_kevin"},"!",{"VAR?":"talked_to_maya"},"&&","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"worked_with_maya"},{"->":".^.^.^.24"},null]}],"nop","\n","ev",{"VAR?":"talked_to_kevin"},"!",{"VAR?":"talked_to_maya"},"!","&&","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"worked_alone"},{"->":".^.^.^.34"},null]}],"nop","\n",null],"worked_with_both":["^Agent 0x99: I noticed you worked with both Kevin and Maya.","\n","^Agent 0x99: Kevin gave you legitimate access—that's the IT contractor cover working as intended.","\n","ev",{"VAR?":"maya_identity_protected"},"/ev",[{"->":".^.b","c":true},{"b":["\n","^Agent 0x99: And Maya... you protected her identity. She's safe. She can continue her journalism without looking over her shoulder.","\n","^Agent 0x99: That matters. She took a risk contacting us.","\n",{"->":".^.^.^.9"},null]}],[{"->":".^.b"},{"b":["\n","^Agent 0x99: Maya's identity was compromised during the operation. We're relocating her for safety.","\n","^Agent 0x99: She'll be okay, but her career at Viral Dynamics is over. Collateral damage.","\n",{"->":".^.^.^.9"},null]}],"nop","\n",{"->":"kevin_frame_discussion"},null],"worked_with_kevin":["^Agent 0x99: Kevin's cooperation was valuable. The IT contractor cover worked perfectly.","\n","^Agent 0x99: You got legitimate access without raising suspicion. That's clean infiltration.","\n",{"->":"kevin_frame_discussion"},null],"worked_with_maya":["^Agent 0x99: Maya was taking a risk talking to you. I hope you appreciated that.","\n","ev",{"VAR?":"maya_identity_protected"},"/ev",[{"->":".^.b","c":true},{"b":["\n","^Agent 0x99: Her identity stayed protected. She can continue investigating on her own terms now.","\n",{"->":".^.^.^.7"},null]}],[{"->":".^.b"},{"b":["\n","^Agent 0x99: Unfortunately, her identity was compromised. We're handling her protection.","\n",{"->":".^.^.^.7"},null]}],"nop","\n",{"->":"kevin_frame_discussion"},null],"worked_alone":["^Agent 0x99: You handled this mostly solo. Independent approach.","\n","^Agent 0x99: Sometimes that's the right call. Fewer people involved means fewer potential leaks.","\n",{"->":"kevin_frame_discussion"},null],"kevin_frame_discussion":["ev",{"VAR?":"kevin_choice"},"str","^","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"security_audit_review"},{"->":".^.^.^.8"},null]}],"nop","\n","ev",{"VAR?":"kevin_choice"},"str","^warn","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"kevin_warned"},{"->":".^.^.^.18"},null]}],"nop","\n","ev",{"VAR?":"kevin_choice"},"str","^evidence","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"kevin_evidence"},{"->":".^.^.^.28"},null]}],"nop","\n","ev",{"VAR?":"kevin_choice"},"str","^ignore","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"kevin_ignored"},{"->":".^.^.^.38"},null]}],"nop","\n",null],"kevin_warned":[["^Agent 0x99: I saw in your report that you warned Kevin about the frame-up.","\n","^Agent 0x99: That was risky. If he'd panicked, if Derek had noticed...","\n","ev","str","^He deserved to know","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^I couldn't just let Derek destroy him","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","^Agent 0x99: He did. And now he's lawyered up, documented everything. When the prosecutors came for him, he was ready.","\n","^Agent 0x99: His career is intact. His life isn't ruined. Because you took five minutes to be decent.","\n",{"->":"kevin_outcome_positive"},null],"c-1":["\n","^Agent 0x99: You're right. Kevin didn't ask to be part of this. He helped you because he's a good person.","\n","^Agent 0x99: Derek would have fed him to the wolves. You didn't let that happen.","\n",{"->":"kevin_outcome_positive"},null]}],null],"kevin_evidence":["^Agent 0x99: The contingency files you left for investigators—that was smart.","\n","^Agent 0x99: When the follow-up team found them, they immediately flagged Kevin as a victim, not a suspect.","\n","^Agent 0x99: He never even knew he was in danger. Woke up, went to work, found out his company was a front for terrorists, and went home to his family.","\n","^Agent 0x99: Clean. Professional. And kind.","\n",{"->":"kevin_outcome_positive"},null],"kevin_outcome_positive":["^Agent 0x99: You know what Derek would have said? \"Kevin is acceptable collateral damage.\"","\n","^Agent 0x99: You disagreed. That matters.","\n","^Agent 0x99: Not every agent would have taken the time. Not every agent would have cared.","\n",{"->":"security_audit_review"},null],"kevin_ignored":[["^Agent 0x99: Kevin Park was arrested this morning.","\n","ev","str","^What?","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^The frame-up worked?","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n",{"->":"kevin_arrest_details"},null],"c-1":["\n",{"->":"kevin_arrest_details"},null]}],null],"kevin_arrest_details":[["^Agent 0x99: Derek's contingency plan activated automatically when Viral Dynamics' systems were seized. Fake logs, forged emails.","\n","^Agent 0x99: Kevin spent six hours in interrogation before our team figured out he was being framed.","\n","^Agent 0x99: He's cleared now. But he's traumatized. His neighbors saw him taken away in handcuffs. His kids watched.","\n","ev","str","^I... I saw the files. I knew.","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^The mission had to come first","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","^Agent 0x99: I know. It's in Derek's computer logs.","\n","^Agent 0x99: You made a choice. Focus on the mission. Let Kevin be collateral damage.","\n","^Agent 0x99: Sometimes that's the right call. Sometimes the mission really does come first.","\n","^Agent 0x99: But Kevin's going to need therapy. His kids are going to need therapy.","\n","^Agent 0x99: Just... remember that. Next time you're weighing priorities.","\n",{"->":"security_audit_review"},null],"c-1":["\n","^Agent 0x99: Did it? You still stopped Operation Shatter. You still caught Derek.","\n","^Agent 0x99: Would five minutes to warn Kevin have changed that?","\n","^Agent 0x99: I'm not judging. Field decisions are hard. But consequences are real.","\n","^Agent 0x99: Kevin's kids watched him get arrested. That happened because of a choice you made.","\n","^Agent 0x99: Live with it. Learn from it.","\n",{"->":"security_audit_review"},null]}],null],"security_audit_review":["ev",{"VAR?":"security_audit_completed"},"/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"audit_feedback"},{"->":".^.^.^.4"},null]}],"nop","\n","ev",{"VAR?":"security_audit_completed"},"!","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"no_audit_feedback"},{"->":".^.^.^.11"},null]}],"nop","\n",null],"audit_feedback":["^Agent 0x99: I noticed you gave Kevin a security assessment during your cover operation.","\n","ev",{"VAR?":"audit_correct_answers"},4,">=","/ev",[{"->":".^.b","c":true},{"b":["\n","^Agent 0x99: Your security analysis was excellent. You identified every major vulnerability correctly.","\n","^Agent 0x99: Physical access controls, Derek's suspicious access patterns, predictable passwords, Patricia's firing, and Derek's unjustified network segmentation.","\n","^Agent 0x99: That's professional-grade security consulting. Your cover was completely convincing.","\n","ev","str","^I wanted to maintain my cover properly","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^The vulnerabilities were pretty obvious once I looked","/str","/ev",{"*":".^.c-1","flg":4},{"->":".^.^.^.8"},{"c-0":["\n","^Agent 0x99: And you did. Kevin trusted you completely because you demonstrated real expertise.","\n","^Agent 0x99: That kind of authentic tradecraft makes all the difference in deep cover work.","\n",{"->":"derek_discussion"},null],"c-1":["\n","^Agent 0x99: Maybe to you. But recognizing them under pressure, while maintaining cover, while gathering intelligence on Operation Shatter?","\n","^Agent 0x99: That's good work. Don't undersell it.","\n",{"->":"derek_discussion"},null]}]}],"nop","\n","ev",{"VAR?":"audit_correct_answers"},3,"==","/ev",[{"->":".^.b","c":true},{"b":["\n","^Agent 0x99: Your security analysis was solid. Three out of five correct assessments.","\n","^Agent 0x99: You identified most of the key vulnerabilities—enough to maintain credibility with Kevin.","\n","^Agent 0x99: A few blind spots, but nothing that compromised your cover or the mission.","\n","ev","str","^Which ones did I miss?","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^I was focused on the bigger picture","/str","/ev",{"*":".^.c-1","flg":4},{"->":".^.^.^.16"},{"c-0":["\n","ev",{"VAR?":"audit_wrong_answers"},1,">=","/ev",[{"->":".^.b","c":true},{"b":["\n","^Agent 0x99: You underestimated a couple of the vulnerabilities Kevin had already flagged.","\n","^Agent 0x99: In the field, always trust when an insider is telling you something's wrong. They see the patterns we miss.","\n",{"->":".^.^.^.7"},null]}],"nop","\n",{"->":"derek_discussion"},null],"c-1":["\n","^Agent 0x99: Fair enough. Your primary mission was Operation Shatter, not a comprehensive security audit.","\n","^Agent 0x99: Kevin bought your cover. That's what mattered.","\n",{"->":"derek_discussion"},null]}]}],"nop","\n","ev",{"VAR?":"audit_correct_answers"},2,"<=","/ev",[{"->":".^.b","c":true},{"b":["\n","^Agent 0x99: Your security assessment was... rough. Two or fewer correct answers out of five.","\n","^Agent 0x99: Kevin was asking you about obvious vulnerabilities he'd already identified. You dismissed most of them.","\n","ev","str","^I was trying not to alarm him","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^Security assessment wasn't my priority","/str","/ev",{"*":".^.c-1","flg":4},{"->":".^.^.^.24"},{"c-0":["\n","^Agent 0x99: Understandable. But when an insider is showing you red flags, validate their concerns.","\n","^Agent 0x99: You're supposed to be a security expert. Kevin needed you to see what he was seeing.","\n","^Agent 0x99: Fortunately, your other actions kept him cooperative. But that assessment almost blew your cover.","\n",{"->":"derek_discussion"},null],"c-1":["\n","^Agent 0x99: It's part of your cover identity. When you're undercover as an expert, you need to be that expert.","\n","^Agent 0x99: Kevin noticed you were missing things he'd already flagged. That could have raised suspicions.","\n","^Agent 0x99: Mission succeeded anyway, but... work on your tradecraft. Deep cover requires authenticity.","\n",{"->":"derek_discussion"},null]}]}],"nop","\n",null],"no_audit_feedback":["^Agent 0x99: I noticed you didn't provide Kevin with a security assessment during your cover operation.","\n","^Agent 0x99: That's fine—it wasn't required for the mission. But it could have strengthened your cover credibility.","\n","^Agent 0x99: Next time you're undercover with a professional identity, look for opportunities to demonstrate authentic expertise.","\n","^Agent 0x99: It builds trust. And trust gives you access.","\n",{"->":"derek_discussion"},null],"derek_discussion":["^Agent 0x99: Now, about Derek Lawson...","\n","ev",{"VAR?":"final_choice"},"str","^arrest","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"consequence_arrest"},{"->":".^.^.^.10"},null]}],"nop","\n","ev",{"VAR?":"final_choice"},"str","^recruit","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"consequence_recruit"},{"->":".^.^.^.20"},null]}],"nop","\n","ev",{"VAR?":"final_choice"},"str","^expose","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n",{"->":"consequence_expose"},{"->":".^.^.^.30"},null]}],"nop","\n",{"->":"consequence_arrest"},null],"consequence_arrest":[["^Agent 0x99: You chose arrest. Legal prosecution through proper channels.","\n","^Agent 0x99: He's not cooperating—true believers rarely do. But we have the evidence. His signature on the casualty projections.","\n","^Agent 0x99: He'll spend decades in prison explaining why 85 dead people would have been \"educational.\"","\n","ev","str","^Will the charges stick?","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^He seemed so certain he was right","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","^Agent 0x99: Conspiracy to commit mass murder. Terrorism. Computer crimes.","\n","ev",{"VAR?":"found_casualty_projections"},"/ev",[{"->":".^.b","c":true},{"b":["\n","^Agent 0x99: With the casualty projections you recovered? He's done.","\n",{"->":".^.^.^.8"},null]}],[{"->":".^.b"},{"b":["\n","^Agent 0x99: We're building the evidence case. It'll take longer, but he's not walking free.","\n",{"->":".^.^.^.8"},null]}],"nop","\n",{"->":"phase_3_discussion"},null],"c-1":["\n","^Agent 0x99: That's what makes true believers dangerous. They've rationalized everything.","\n","^Agent 0x99: Derek doesn't think he's a murderer. He thinks he's an educator.","\n","^Agent 0x99: The jury will disagree.","\n",{"->":"phase_3_discussion"},null]}],null],"consequence_recruit":[["^Agent 0x99: You offered him a chance to cooperate. Turn informant.","\n","^Agent 0x99: I heard his answer. \"I will never betray ENTROPY.\"","\n","^Agent 0x99: True believers don't turn, ","ev",{"VAR?":"player_name"},"out","/ev","^. They'd rather go to prison as martyrs.","\n","ev","str","^I had to try","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^I thought maybe he'd want to reduce his sentence","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","^Agent 0x99: It was worth asking. His refusal tells us something about ENTROPY's organizational culture.","\n","^Agent 0x99: These aren't mercenaries. They're ideologues. That's useful intelligence.","\n",{"->":"recruit_outcome"},null],"c-1":["\n","^Agent 0x99: A rational person would. Derek isn't rational. He's a believer.","\n","^Agent 0x99: His ideology matters more than his freedom.","\n",{"->":"recruit_outcome"},null]}],null],"recruit_outcome":["^Agent 0x99: He's in custody now. Same outcome as arrest.","\n","^Agent 0x99: But we learned something important: ENTROPY attracts true believers. They won't flip for deals.","\n","^Agent 0x99: We'll need to find other ways to get inside intelligence.","\n",{"->":"phase_3_discussion"},null],"consequence_expose":[["^Agent 0x99: Public disclosure. Full transparency.","\n","^Agent 0x99: The casualty projections are on every news site. Derek's death calculations. The targeting lists.","\n","^Agent 0x99: The world now knows what ENTROPY was willing to do.","\n","ev","str","^People deserve to know","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^Let them see who Derek really is","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","^Agent 0x99: Maybe. But now ENTROPY knows we're onto Operation Shatter methodology.","\n","^Agent 0x99: They'll adapt. Change tactics. We've lost the element of surprise.","\n",{"->":"expose_outcome"},null],"c-1":["\n","^Agent 0x99: They're seeing. \"Acceptable losses.\" \"Educational deaths.\"","\n","^Agent 0x99: The public is horrified. Good. They should be.","\n",{"->":"expose_outcome"},null]}],null],"expose_outcome":["^Agent 0x99: Director Netherton is... not happy. We don't usually expose methods.","\n","^Agent 0x99: But ENTROPY's tactics are now public knowledge. People know to verify. To question.","\n","^Agent 0x99: In a twisted way, you taught the lesson Derek wanted—just without the deaths.","\n","ev",{"VAR?":"maya_identity_protected"},"/ev",[{"->":".^.b","c":true},{"b":["\n","^Agent 0x99: At least Maya's identity stayed protected through all this.","\n",{"->":".^.^.^.11"},null]}],[{"->":".^.b"},{"b":["\n","^Agent 0x99: Maya's identity came out in the disclosure. She's being handled as a public whistleblower now.","\n",{"->":".^.^.^.11"},null]}],"nop","\n",{"->":"phase_3_discussion"},null],"phase_3_discussion":[["^Agent 0x99: ","ev",{"VAR?":"player_name"},"out","/ev","^, I need you to understand what we learned today.","\n","^Agent 0x99: We always thought ENTROPY was sophisticated cybercrime. Data theft. Corporate espionage.","\n","^Agent 0x99: This is different. Derek had casualty projections. He calculated deaths and considered them acceptable.","\n","ev","str","^They're willing to kill for their ideology","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^What does that mean for future missions?","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n",{"->":"true_nature"},null],"c-1":["\n",{"->":"true_nature"},null]}],null],"true_nature":[["^Agent 0x99: It means we're not fighting criminals. We're fighting true believers.","\n","^Agent 0x99: People who think killing people is \"education.\" Who see deaths as \"acceptable losses.\"","\n","^Agent 0x99: And if Social Fabric was willing to do this... what are the other cells planning?","\n","ev","str","^Who is The Architect?","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^How do we stop them?","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n",{"->":"architect_mystery"},null],"c-1":["\n",{"->":"stop_entropy"},null]}],null],"architect_mystery":[["^Agent 0x99: We don't know. ENTROPY's leader, strategist, philosopher.","\n","^Agent 0x99: Derek quoted The Architect. Believed every word. Got approval to kill 85 people.","\n","^Agent 0x99: Whoever they are, they've built an organization of true believers.","\n","ev","str","^We have to find them","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^That sounds terrifying","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","^Agent 0x99: Every cell we disrupt, every operation we stop, brings us closer.","\n","ev",{"VAR?":"lore_collected"},3,">=","/ev",[{"->":".^.b","c":true},{"b":["\n","^Agent 0x99: The intelligence you collected today gives us new leads. The Architect's communication patterns. Their philosophical fingerprints.","\n",{"->":".^.^.^.9"},null]}],"nop","\n",{"->":"mission_end"},null],"c-1":["\n","^Agent 0x99: It is. But that's why SAFETYNET exists.","\n","^Agent 0x99: Today, you stood between ENTROPY and 85 people they'd sacrifice.","\n",{"->":"mission_end"},null]}],null],"stop_entropy":["^Agent 0x99: Cell by cell. Operation by operation.","\n","^Agent 0x99: Today you stopped Operation Shatter. Tomorrow, we stop the next one.","\n",{"->":"mission_end"},null],"mission_end":["^Agent 0x99: First mission complete. Lives saved. True believer in custody.","\n","ev",{"VAR?":"lore_collected"},3,">=","/ev",[{"->":".^.b","c":true},{"b":["\n","^Agent 0x99: And ","ev",{"VAR?":"lore_collected"},"out","/ev","^ intelligence fragments recovered. That's thorough investigative work.","\n",{"->":".^.^.^.8"},null]}],"nop","\n","ev",{"VAR?":"lore_collected"},0,"==","/ev",[{"->":".^.b","c":true},{"b":["\n","^Agent 0x99: You focused on the primary objectives. Efficient.","\n","^Agent 0x99: But next time, look for additional intelligence. Context helps future operations.","\n",{"->":".^.^.^.16"},null]}],"nop","\n","^Agent 0x99: Get some rest. Next briefing is in 48 hours.","\n","^Agent 0x99: And ","ev",{"VAR?":"player_name"},"out","/ev","^? You did more than complete a mission today.","\n","^Agent 0x99: You saved lives. Real people who will never know your name.","\n","^Agent 0x99: That's what SAFETYNET is for.","\n","^[MISSION COMPLETE: FIRST CONTACT]","\n","ev",{"VAR?":"final_choice"},"str","^arrest","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n","^[OUTCOME: Derek Lawson arrested - Prosecution pending]","\n",{"->":".^.^.^.41"},null]}],"nop","\n","ev",{"VAR?":"final_choice"},"str","^recruit","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n","^[OUTCOME: Derek Lawson arrested - Refused cooperation]","\n",{"->":".^.^.^.51"},null]}],"nop","\n","ev",{"VAR?":"final_choice"},"str","^expose","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n","^[OUTCOME: Full public disclosure - ENTROPY methods exposed]","\n",{"->":".^.^.^.61"},null]}],"nop","\n","^[OPERATION SHATTER: NEUTRALIZED]","\n","^[LIVES SAVED: 42-85 (estimated)]","\n","ev",{"VAR?":"found_casualty_projections"},{"VAR?":"found_target_database"},"&&","/ev",[{"->":".^.b","c":true},{"b":["\n","^[EVIDENCE: COMPLETE - All critical documents recovered]","\n",{"->":".^.^.^.73"},null]}],"nop","\n","ev",{"VAR?":"found_casualty_projections"},{"VAR?":"found_target_database"},"!","&&","/ev",[{"->":".^.b","c":true},{"b":["\n","^[EVIDENCE: SUBSTANTIAL - Casualty projections secured]","\n",{"->":".^.^.^.82"},null]}],"nop","\n","ev",{"VAR?":"found_casualty_projections"},"!",{"VAR?":"found_target_database"},"&&","/ev",[{"->":".^.b","c":true},{"b":["\n","^[EVIDENCE: SUBSTANTIAL - Target database secured]","\n",{"->":".^.^.^.91"},null]}],"nop","\n","ev",{"VAR?":"found_casualty_projections"},"!",{"VAR?":"found_target_database"},"!","&&","/ev",[{"->":".^.b","c":true},{"b":["\n","^[EVIDENCE: PARTIAL - Forensics team recovering additional files]","\n",{"->":".^.^.^.101"},null]}],"nop","\n","ev",{"VAR?":"maya_identity_protected"},"/ev",[{"->":".^.b","c":true},{"b":["\n","^[MAYA CHEN: Identity protected]","\n",{"->":".^.^.^.108"},null]}],[{"->":".^.b"},{"b":["\n","^[MAYA CHEN: Identity compromised - Under SAFETYNET protection]","\n",{"->":".^.^.^.108"},null]}],"nop","\n","ev",{"VAR?":"kevin_protected"},"/ev",[{"->":".^.b","c":true},{"b":["\n","^[KEVIN PARK: Protected from frame-up - Career intact]","\n",{"->":".^.^.^.114"},null]}],"nop","\n","ev",{"VAR?":"kevin_choice"},"str","^ignore","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n","^[KEVIN PARK: Arrested, later cleared - Traumatized but free]","\n",{"->":".^.^.^.124"},null]}],"nop","\n","ev",{"VAR?":"kevin_choice"},"str","^","/str","==","/ev",[{"->":".^.b","c":true},{"b":["\n","^[KEVIN PARK: Status unknown]","\n",{"->":".^.^.^.134"},null]}],"nop","\n","^[The Architect remains at large...]","\n","#","^exit_conversation","/#","end",null],"global decl":["ev","str","^Agent 0x00","/str",{"VAR=":"player_name"},"str","^","/str",{"VAR=":"final_choice"},0,{"VAR=":"objectives_completed"},0,{"VAR=":"lore_collected"},false,{"VAR=":"found_casualty_projections"},false,{"VAR=":"found_target_database"},false,{"VAR=":"talked_to_maya"},false,{"VAR=":"talked_to_kevin"},true,{"VAR=":"maya_identity_protected"},"str","^","/str",{"VAR=":"kevin_choice"},false,{"VAR=":"kevin_protected"},false,{"VAR=":"security_audit_completed"},0,{"VAR=":"audit_correct_answers"},0,{"VAR=":"audit_wrong_answers"},"/ev","end",null]}],"listDefs":{}}
\ No newline at end of file
diff --git a/scenarios/m01_first_contact/ink/m01_npc_kevin.ink b/scenarios/m01_first_contact/ink/m01_npc_kevin.ink
index 778d1f5..406b4e4 100644
--- a/scenarios/m01_first_contact/ink/m01_npc_kevin.ink
+++ b/scenarios/m01_first_contact/ink/m01_npc_kevin.ink
@@ -14,6 +14,12 @@ VAR given_keycard = false
 VAR given_password_hints = false
 VAR warned_about_derek = false
 
+// Security Audit Variables
+VAR security_audit_given = false
+VAR audit_questions_asked = 0
+VAR audit_correct_answers = 0
+VAR audit_wrong_answers = 0
+
 // ================================================
 // START: FIRST MEETING
 // ================================================
@@ -171,6 +177,8 @@ Kevin: And some notes on password patterns people use around here. Should help w
     -> ask_passwords
 + {not asked_about_derek and influence >= 3} [What else can you tell me about Derek?]
     -> ask_about_derek
++ {not security_audit_given and (given_lockpick or given_keycard) and influence >= 2} [I'd like to give you a preliminary security audit update]
+    -> security_audit_start
 + [I'll keep investigating. Thanks for the help.]
     #exit_conversation
     Kevin: No problem. And seriously—if you find anything, let me know. I need to know I'm not going crazy.
@@ -252,10 +260,199 @@ Kevin: Said it was for "client confidentiality" but... marketing doesn't need th
 
 + [What do you think he's really doing?]
     Kevin: I don't know. But whatever it is, it's not marketing.
-    Kevin: He's been meeting with external people—calls them "partners." 
+    Kevin: He's been meeting with external people—calls them "partners."
     Kevin: I saw notes once that mentioned something called "Operation Shatter."
     ~ influence += 2
     -> hub
 + [Maybe he's just paranoid]
     Kevin: Maybe. But Patricia didn't think so. And now she's gone.
     -> hub
+
+// ================================================
+// SECURITY AUDIT - MCQ Assessment
+// ================================================
+
+=== security_audit_start ===
+~ security_audit_given = true
+#set_variable:security_audit_completed=true
+
+Kevin: Oh! Yeah, I'd love to hear what you've found so far.
+
+Kevin: I mean, you're the professional. What's your assessment of our security posture?
+
+Player: I've been observing and testing. Let me give you some preliminary findings.
+
+Kevin: Please, go ahead. I need to know if I'm overreacting or if we really do have problems.
+
+-> audit_question_1
+
+// ================================================
+// AUDIT QUESTION 1: Physical Security
+// ================================================
+
+=== audit_question_1 ===
+~ audit_questions_asked += 1
+
+Player: First, let's talk about physical security. What would you say is the most significant concern?
+
++ [The building's physical access controls are adequate for a company this size]
+    ~ audit_wrong_answers += 1
+    Kevin: Really? I was worried about those old door locks...
+    Kevin: But I guess if you think they're adequate, maybe I'm being paranoid.
+    -> audit_question_2
++ [The old mechanical locks and that PIN pad on the IT room are easily bypassed]
+    ~ audit_correct_answers += 1
+    ~ influence += 1
+    Kevin: Yes! That's exactly what I've been saying!
+    Kevin: I requested modern electronic locks six months ago. Budget was "under review."
+    Kevin: Anyone with basic lockpicking skills could get into most rooms here.
+    -> audit_question_2
++ [Physical security isn't really a priority compared to digital security]
+    ~ audit_wrong_answers += 1
+    Kevin: Hmm. I thought physical access was important, but you're the expert.
+    Kevin: I guess I should focus more on the digital side then.
+    -> audit_question_2
+
+// ================================================
+// AUDIT QUESTION 2: Access Control
+// ================================================
+
+=== audit_question_2 ===
+~ audit_questions_asked += 1
+
+Player: Second question—I've been reviewing the access logs. What concerns you most about the patterns?
+
++ [Everything looks normal. Standard office hours access mostly]
+    ~ audit_wrong_answers += 1
+    Kevin: But... what about those 2 AM logins to the server room?
+    Kevin: Maybe I'm reading too much into it.
+    -> audit_question_3
++ [Derek's credentials being used for server room access at 2 AM is a red flag]
+    ~ audit_correct_answers += 1
+    ~ influence += 1
+    Kevin: Thank you! I knew I wasn't crazy!
+    Kevin: Management keeps telling me he's just "dedicated" and "works odd hours."
+    Kevin: But we don't have anything in that server room that marketing should be accessing at all.
+    -> audit_question_3
++ [The access logs seem fine, but you should implement better monitoring]
+    ~ audit_wrong_answers += 1
+    Kevin: I thought the current logs were already showing problems...
+    Kevin: But yeah, better monitoring couldn't hurt.
+    -> audit_question_3
+
+// ================================================
+// AUDIT QUESTION 3: Password Security
+// ================================================
+
+=== audit_question_3 ===
+~ audit_questions_asked += 1
+
+Player: Third—password security. What's your assessment of the biggest vulnerability?
+
++ [Your password complexity requirements are sufficient]
+    ~ audit_wrong_answers += 1
+    Kevin: I guess the requirements are technically there...
+    Kevin: I just worry people are finding predictable ways around them.
+    -> audit_question_4
++ [Staff are using predictable patterns—birthdays, company name plus numbers]
+    ~ audit_correct_answers += 1
+    ~ influence += 1
+    Kevin: Exactly! I see it all the time in password reset requests.
+    Kevin: "Viral2023" "Viral2024" - I've warned people but they keep doing it.
+    Kevin: And Derek... well, you've probably figured out his pattern by now.
+    -> audit_question_4
++ [Passwords aren't the real issue—focus on multi-factor authentication instead]
+    ~ audit_wrong_answers += 1
+    Kevin: We don't have MFA yet—budget constraints.
+    Kevin: So I'm stuck with just passwords for now. Wish we could implement MFA.
+    -> audit_question_4
+
+// ================================================
+// AUDIT QUESTION 4: Personnel Security
+// ================================================
+
+=== audit_question_4 ===
+~ audit_questions_asked += 1
+
+Player: Fourth—personnel security. What's the biggest red flag you see?
+
++ [The staff seem trustworthy. No major concerns]
+    ~ audit_wrong_answers += 1
+    Kevin: I want to believe that, I really do.
+    Kevin: But Patricia's firing still bothers me.
+    -> audit_question_5
++ [A manager investigating security concerns was suddenly fired—that's suspicious]
+    ~ audit_correct_answers += 1
+    ~ influence += 2
+    Kevin: Right?! That's what worries me most!
+    Kevin: Patricia was asking the right questions. Then she was gone.
+    Kevin: And nobody will tell me why. Just "performance issues."
+    Kevin: It sends a message: don't ask questions about Derek.
+    -> audit_question_5
++ [You need better background checks and security clearances]
+    ~ audit_wrong_answers += 1
+    Kevin: I mean, we do background checks for sensitive positions...
+    Kevin: But yeah, we could probably do better.
+    -> audit_question_5
+
+// ================================================
+// AUDIT QUESTION 5: Data Protection
+// ================================================
+
+=== audit_question_5 ===
+~ audit_questions_asked += 1
+
+Player: Finally—data protection practices. What concerns you about how sensitive data is handled here?
+
++ [Standard security practices seem to be followed adequately]
+    ~ audit_wrong_answers += 1
+    Kevin: I suppose most people follow the basics...
+    Kevin: Though Derek's setup still seems excessive to me.
+    -> audit_complete
++ [Derek's encrypted comms and separate network segments lack business justification]
+    ~ audit_correct_answers += 1
+    ~ influence += 2
+    Kevin: Yes! That's exactly it!
+    Kevin: Marketing doesn't need that level of segmentation. We're not handling credit cards or medical records.
+    Kevin: He claims it's for "client confidentiality" but I've never seen documentation justifying the architecture.
+    Kevin: It looks less like security and more like... hiding something.
+    -> audit_complete
++ [You need better encryption across the board]
+    ~ audit_wrong_answers += 1
+    Kevin: We have encryption where we need it...
+    Kevin: Though I guess more couldn't hurt?
+    -> audit_complete
+
+// ================================================
+// AUDIT COMPLETE - Kevin's Response
+// ================================================
+
+=== audit_complete ===
+
+Kevin: Thank you. Seriously, thank you for taking the time to go through this with me.
+
+{audit_correct_answers >= 4:
+    Kevin: You really understand what's happening here. Everything you've flagged matches my concerns exactly.
+    Kevin: It's such a relief to have a professional validate what I've been seeing.
+    Kevin: I've felt like I'm going crazy, or being paranoid. But you see it too.
+    ~ influence += 3
+}
+{audit_correct_answers == 3:
+    Kevin: You've identified some key issues. A few things we see differently, but overall you're confirming my main worries.
+    Kevin: At least I know I'm not completely off base with my concerns.
+    ~ influence += 2
+}
+{audit_correct_answers <= 2:
+    Kevin: I appreciate the feedback, even if we see some things differently.
+    Kevin: Maybe I am being too paranoid about some of this stuff.
+    Kevin: But... I still can't shake the feeling something's wrong here.
+    ~ influence += 1
+}
+
+Kevin: I'm going to document your findings in my incident log.
+
+Kevin: If management won't listen to me, maybe they'll listen to the security auditor.
+
+Kevin: Keep investigating. And please—if you find anything concrete, tell me immediately.
+
+-> hub
diff --git a/scenarios/m01_first_contact/ink/m01_npc_kevin.json b/scenarios/m01_first_contact/ink/m01_npc_kevin.json
index 7a1b4e4..301bb37 100644
--- a/scenarios/m01_first_contact/ink/m01_npc_kevin.json
+++ b/scenarios/m01_first_contact/ink/m01_npc_kevin.json
@@ -1 +1 @@
-{"inkVersion":21,"root":[[["done",{"#n":"g-0"}],null],"done",{"start":["#","^set_variable:talked_to_kevin=true","/#","ev",{"VAR?":"met_kevin"},"!","/ev",[{"->":".^.b","c":true},{"b":["\n","ev",true,"/ev",{"VAR=":"met_kevin","re":true},"ev",{"VAR?":"influence"},2,"+",{"VAR=":"influence","re":true},"/ev","^Kevin: Oh hey! You found the IT room. I'm Kevin—IT manager, sole IT department, and professional worrier.","\n","^Kevin: You're the security auditor, right? Thank god you're here.","\n","^Kevin: I've been telling them we need a review for months.","\n",{"->":"first_meeting"},{"->":"start.8"},null]}],"nop","\n","ev",{"VAR?":"met_kevin"},"/ev",[{"->":".^.b","c":true},{"b":["\n","^Kevin: Hey, what's up? Found anything interesting yet?","\n",{"->":"hub"},{"->":"start.14"},null]}],"nop","\n",null],"first_meeting":[["#","^complete_task:meet_kevin","/#","ev","str","^Happy to help. What's the security situation?","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^I'll need access to secure areas for testing","/str","/ev",{"*":".^.c-1","flg":4},"ev","str","^You seem stressed","/str","/ev",{"*":".^.c-2","flg":4},{"c-0":["\n","ev",{"VAR?":"influence"},2,"+",{"VAR=":"influence","re":true},"/ev","ev",true,"/ev",{"VAR=":"discussed_audit","re":true},{"->":"security_situation"},null],"c-1":["\n","ev",true,"/ev",{"VAR=":"discussed_audit","re":true},{"->":"access_discussion"},null],"c-2":["\n","ev",{"VAR?":"influence"},1,"+",{"VAR=":"influence","re":true},"/ev","ev",true,"/ev",{"VAR=":"discussed_audit","re":true},{"->":"kevin_stress"},null]}],null],"security_situation":[["^Kevin: Honestly? I'm worried.","\n","^Kevin: Someone's been accessing the server room without authorization. Late at night. Multiple times.","\n","^Kevin: I flagged it to management three times. Nothing happened.","\n","ev","str","^Who do you think it is?","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^That's what I'm here to investigate","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","ev",true,"/ev",{"VAR=":"warned_about_derek","re":true},"ev",{"VAR?":"influence"},1,"+",{"VAR=":"influence","re":true},"/ev",{"->":"derek_suspicion"},null],"c-1":["\n","^Kevin: Good. Because I'm starting to feel like I'm the only one who cares about security around here.","\n",{"->":"offer_tools"},null]}],null],"derek_suspicion":[["^Kevin: *lowers voice* I think it's Derek Lawson. Senior Marketing Manager.","\n","^Kevin: The access logs show his credentials being used at 2 AM. But he says it's for \"campaign servers.\"","\n","^Kevin: We don't have campaign servers in that room. It's all internal infrastructure.","\n","^Kevin: The last person who raised concerns about Derek was Patricia—our manager. She got fired.","\n","ev","str","^I'll look into it","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^Could be someone spoofing his credentials","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","ev",{"VAR?":"influence"},2,"+",{"VAR=":"influence","re":true},"/ev","^Kevin: Please do. But be careful. Derek has friends in high places.","\n","^Kevin: Here, let me give you some tools that might help.","\n",{"->":"offer_tools"},null],"c-1":["\n","^Kevin: Maybe. But I don't think so. I've seen him leaving the office at weird hours.","\n",{"->":"offer_tools"},null]}],null],"access_discussion":["^Kevin: Right, you'll need access to secure areas.","\n","^Kevin: I've got a keycard for the server room. It's behind Derek's office, actually.","\n","^Kevin: And for physical security testing, I've got something special.","\n",{"->":"offer_tools"},null],"kevin_stress":[["^Kevin: Yeah, it's been a rough few months.","\n","^Kevin: Ever since Patricia got fired, things have felt... off.","\n","^Kevin: She was investigating something. Asking questions about Derek's projects.","\n","^Kevin: Now she's gone and nobody will tell me why.","\n","ev","str","^What was she investigating?","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^Let's focus on the audit","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","ev",true,"/ev",{"VAR=":"warned_about_derek","re":true},"^Kevin: I don't know exactly. Something about Derek's \"external partners.\"","\n","^Kevin: She kept her notes in her office safe. I think her briefcase is still in there too.","\n",{"->":"offer_tools"},null],"c-1":["\n","^Kevin: Right. Sorry. Let me get you set up.","\n",{"->":"offer_tools"},null]}],null],"offer_tools":[["^Kevin: Okay, so for the audit I can give you:","\n","^Kevin: First, a lockpick set. I bought it for when people lock themselves out, but it's useful for testing physical security.","\n","^Kevin: Second, my server room keycard. You'll need it to access the main servers.","\n","^Kevin: And some notes on password patterns people use around here. Should help with the technical testing.","\n","ev","str","^I'll take all of it","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^Just the keycard for now","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","ev",true,"/ev",{"VAR=":"given_lockpick","re":true},"ev",true,"/ev",{"VAR=":"given_keycard","re":true},"ev",true,"/ev",{"VAR=":"given_password_hints","re":true},"ev",{"VAR?":"influence"},3,"+",{"VAR=":"influence","re":true},"/ev","#","^give_item:lockpick","/#","#","^give_item:keycard","/#","#","^give_item:notes","/#","^Kevin: Here you go. The lockpicks work on most of the older locks around here.","\n","^Kevin: The server room is through Derek's office—there's a door on the east side.","\n","^Kevin: Just... be careful, okay? Something's not right here.","\n",{"->":"hub"},null],"c-1":["\n","ev",true,"/ev",{"VAR=":"given_keycard","re":true},"#","^give_item:keycard","/#","^Kevin: Sure. Server room is through Derek's office. Let me know if you need anything else.","\n",{"->":"hub"},null]}],null],"hub":[["ev","str","^About those lockpicks...","/str",{"VAR?":"given_lockpick"},"!","/ev",{"*":".^.c-0","flg":5},"ev","str","^I need the server room keycard","/str",{"VAR?":"given_keycard"},"!","/ev",{"*":".^.c-1","flg":5},"ev","str","^Tell me about password security here","/str",{"VAR?":"asked_about_passwords"},"!",{"VAR?":"influence"},2,">=","&&","/ev",{"*":".^.c-2","flg":5},"ev","str","^What else can you tell me about Derek?","/str",{"VAR?":"asked_about_derek"},"!",{"VAR?":"influence"},3,">=","&&","/ev",{"*":".^.c-3","flg":5},"ev","str","^I'll keep investigating. Thanks for the help.","/str","/ev",{"*":".^.c-4","flg":4},{"c-0":["\n",{"->":"get_lockpicks"},null],"c-1":["\n",{"->":"get_keycard"},null],"c-2":["\n",{"->":"ask_passwords"},null],"c-3":["\n",{"->":"ask_about_derek"},null],"c-4":["\n","#","^exit_conversation","/#","^Kevin: No problem. And seriously—if you find anything, let me know. I need to know I'm not going crazy.","\n",{"->":"hub"},null]}],null],"get_lockpicks":["ev",true,"/ev",{"VAR=":"given_lockpick","re":true},"#","^give_item:lockpick","/#","^Kevin: Here's the lockpick set. It's professional grade.","\n","^Kevin: Most of the older locks in the building are vulnerable. Good for testing security.","\n","^Kevin: Patricia's office has an old briefcase she left behind. You might be able to pick that open if you're curious what she was working on.","\n",{"->":"hub"},null],"get_keycard":["ev",true,"/ev",{"VAR=":"given_keycard","re":true},"#","^give_item:keycard","/#","^Kevin: Here's my server room keycard.","\n","^Kevin: The server room is through Derek's office—there's a connecting door on the east wall.","\n","^Kevin: The servers hold everything. If there's evidence of unauthorized activity, that's where you'll find it.","\n",{"->":"hub"},null],"ask_passwords":[["ev",true,"/ev",{"VAR=":"asked_about_passwords","re":true},"ev",true,"/ev",{"VAR=":"given_password_hints","re":true},"ev",{"VAR?":"influence"},1,"+",{"VAR=":"influence","re":true},"/ev","#","^give_item:notes","/#","^Kevin: Password security here is... not great.","\n","^Kevin: I enforce complexity requirements on domain accounts, but people find patterns.","\n","^Kevin: Company name plus numbers. Birthdays. Anniversary dates.","\n","^Kevin: Derek uses his birthday or anniversary in everything. April 19th. Makes his passwords easy to guess.","\n","ev","str","^0419?","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^That's useful, thanks","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","ev",{"VAR?":"influence"},2,"+",{"VAR=":"influence","re":true},"/ev","^Kevin: Yeah. I've told him it's a security risk but he doesn't listen.","\n","^Kevin: Here, I wrote down the common patterns people use. Might help with the audit.","\n",{"->":"hub"},null],"c-1":["\n",{"->":"hub"},null]}],null],"ask_about_derek":[["ev",true,"/ev",{"VAR=":"asked_about_derek","re":true},"ev",{"VAR?":"influence"},1,"+",{"VAR=":"influence","re":true},"/ev","^Kevin: Derek's been here about 18 months. Senior Marketing Manager.","\n","^Kevin: At first he seemed normal. Then he started requesting \"enhanced privacy\" for his systems.","\n","^Kevin: Wanted separate network segments, encrypted communications, locked office at all times.","\n","^Kevin: Said it was for \"client confidentiality\" but... marketing doesn't need that level of security.","\n","ev","str","^What do you think he's really doing?","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^Maybe he's just paranoid","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","^Kevin: I don't know. But whatever it is, it's not marketing.","\n","^Kevin: He's been meeting with external people—calls them \"partners.\"","\n","^Kevin: I saw notes once that mentioned something called \"Operation Shatter.\"","\n","ev",{"VAR?":"influence"},2,"+",{"VAR=":"influence","re":true},"/ev",{"->":"hub"},null],"c-1":["\n","^Kevin: Maybe. But Patricia didn't think so. And now she's gone.","\n",{"->":"hub"},null]}],null],"global decl":["ev",0,{"VAR=":"influence"},false,{"VAR=":"met_kevin"},false,{"VAR=":"discussed_audit"},false,{"VAR=":"asked_about_derek"},false,{"VAR=":"asked_about_passwords"},false,{"VAR=":"given_lockpick"},false,{"VAR=":"given_keycard"},false,{"VAR=":"given_password_hints"},false,{"VAR=":"warned_about_derek"},"/ev","end",null]}],"listDefs":{}}
\ No newline at end of file
+{"inkVersion":21,"root":[[["done",{"#n":"g-0"}],null],"done",{"start":["#","^set_variable:talked_to_kevin=true","/#","ev",{"VAR?":"met_kevin"},"!","/ev",[{"->":".^.b","c":true},{"b":["\n","ev",true,"/ev",{"VAR=":"met_kevin","re":true},"ev",{"VAR?":"influence"},2,"+",{"VAR=":"influence","re":true},"/ev","^Kevin: Oh hey! You found the IT room. I'm Kevin—IT manager, sole IT department, and professional worrier.","\n","^Kevin: You're the security auditor, right? Thank god you're here.","\n","^Kevin: I've been telling them we need a review for months.","\n",{"->":"first_meeting"},{"->":"start.8"},null]}],"nop","\n","ev",{"VAR?":"met_kevin"},"/ev",[{"->":".^.b","c":true},{"b":["\n","^Kevin: Hey, what's up? Found anything interesting yet?","\n",{"->":"hub"},{"->":"start.14"},null]}],"nop","\n",null],"first_meeting":[["#","^complete_task:meet_kevin","/#","ev","str","^Happy to help. What's the security situation?","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^I'll need access to secure areas for testing","/str","/ev",{"*":".^.c-1","flg":4},"ev","str","^You seem stressed","/str","/ev",{"*":".^.c-2","flg":4},{"c-0":["\n","ev",{"VAR?":"influence"},2,"+",{"VAR=":"influence","re":true},"/ev","ev",true,"/ev",{"VAR=":"discussed_audit","re":true},{"->":"security_situation"},null],"c-1":["\n","ev",true,"/ev",{"VAR=":"discussed_audit","re":true},{"->":"access_discussion"},null],"c-2":["\n","ev",{"VAR?":"influence"},1,"+",{"VAR=":"influence","re":true},"/ev","ev",true,"/ev",{"VAR=":"discussed_audit","re":true},{"->":"kevin_stress"},null]}],null],"security_situation":[["^Kevin: Honestly? I'm worried.","\n","^Kevin: Someone's been accessing the server room without authorization. Late at night. Multiple times.","\n","^Kevin: I flagged it to management three times. Nothing happened.","\n","ev","str","^Who do you think it is?","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^That's what I'm here to investigate","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","ev",true,"/ev",{"VAR=":"warned_about_derek","re":true},"ev",{"VAR?":"influence"},1,"+",{"VAR=":"influence","re":true},"/ev",{"->":"derek_suspicion"},null],"c-1":["\n","^Kevin: Good. Because I'm starting to feel like I'm the only one who cares about security around here.","\n",{"->":"offer_tools"},null]}],null],"derek_suspicion":[["^Kevin: *lowers voice* I think it's Derek Lawson. Senior Marketing Manager.","\n","^Kevin: The access logs show his credentials being used at 2 AM. But he says it's for \"campaign servers.\"","\n","^Kevin: We don't have campaign servers in that room. It's all internal infrastructure.","\n","^Kevin: The last person who raised concerns about Derek was Patricia—our manager. She got fired.","\n","ev","str","^I'll look into it","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^Could be someone spoofing his credentials","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","ev",{"VAR?":"influence"},2,"+",{"VAR=":"influence","re":true},"/ev","^Kevin: Please do. But be careful. Derek has friends in high places.","\n","^Kevin: Here, let me give you some tools that might help.","\n",{"->":"offer_tools"},null],"c-1":["\n","^Kevin: Maybe. But I don't think so. I've seen him leaving the office at weird hours.","\n",{"->":"offer_tools"},null]}],null],"access_discussion":["^Kevin: Right, you'll need access to secure areas.","\n","^Kevin: I've got a keycard for the server room. It's behind Derek's office, actually.","\n","^Kevin: And for physical security testing, I've got something special.","\n",{"->":"offer_tools"},null],"kevin_stress":[["^Kevin: Yeah, it's been a rough few months.","\n","^Kevin: Ever since Patricia got fired, things have felt... off.","\n","^Kevin: She was investigating something. Asking questions about Derek's projects.","\n","^Kevin: Now she's gone and nobody will tell me why.","\n","ev","str","^What was she investigating?","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^Let's focus on the audit","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","ev",true,"/ev",{"VAR=":"warned_about_derek","re":true},"^Kevin: I don't know exactly. Something about Derek's \"external partners.\"","\n","^Kevin: She kept her notes in her office safe. I think her briefcase is still in there too.","\n",{"->":"offer_tools"},null],"c-1":["\n","^Kevin: Right. Sorry. Let me get you set up.","\n",{"->":"offer_tools"},null]}],null],"offer_tools":[["^Kevin: Okay, so for the audit I can give you:","\n","^Kevin: First, a lockpick set. I bought it for when people lock themselves out, but it's useful for testing physical security.","\n","^Kevin: Second, my server room keycard. You'll need it to access the main servers.","\n","^Kevin: And some notes on password patterns people use around here. Should help with the technical testing.","\n","ev","str","^I'll take all of it","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^Just the keycard for now","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","ev",true,"/ev",{"VAR=":"given_lockpick","re":true},"ev",true,"/ev",{"VAR=":"given_keycard","re":true},"ev",true,"/ev",{"VAR=":"given_password_hints","re":true},"ev",{"VAR?":"influence"},3,"+",{"VAR=":"influence","re":true},"/ev","#","^give_item:lockpick","/#","#","^give_item:keycard","/#","#","^give_item:notes","/#","^Kevin: Here you go. The lockpicks work on most of the older locks around here.","\n","^Kevin: The server room is through Derek's office—there's a door on the east side.","\n","^Kevin: Just... be careful, okay? Something's not right here.","\n",{"->":"hub"},null],"c-1":["\n","ev",true,"/ev",{"VAR=":"given_keycard","re":true},"#","^give_item:keycard","/#","^Kevin: Sure. Server room is through Derek's office. Let me know if you need anything else.","\n",{"->":"hub"},null]}],null],"hub":[["ev","str","^About those lockpicks...","/str",{"VAR?":"given_lockpick"},"!","/ev",{"*":".^.c-0","flg":5},"ev","str","^I need the server room keycard","/str",{"VAR?":"given_keycard"},"!","/ev",{"*":".^.c-1","flg":5},"ev","str","^Tell me about password security here","/str",{"VAR?":"asked_about_passwords"},"!",{"VAR?":"influence"},2,">=","&&","/ev",{"*":".^.c-2","flg":5},"ev","str","^What else can you tell me about Derek?","/str",{"VAR?":"asked_about_derek"},"!",{"VAR?":"influence"},3,">=","&&","/ev",{"*":".^.c-3","flg":5},"ev","str","^I'd like to give you a preliminary security audit update","/str",{"VAR?":"security_audit_given"},"!",{"VAR?":"given_lockpick"},{"VAR?":"given_keycard"},"||","&&",{"VAR?":"influence"},2,">=","&&","/ev",{"*":".^.c-4","flg":5},"ev","str","^I'll keep investigating. Thanks for the help.","/str","/ev",{"*":".^.c-5","flg":4},{"c-0":["\n",{"->":"get_lockpicks"},null],"c-1":["\n",{"->":"get_keycard"},null],"c-2":["\n",{"->":"ask_passwords"},null],"c-3":["\n",{"->":"ask_about_derek"},null],"c-4":["\n",{"->":"security_audit_start"},null],"c-5":["\n","#","^exit_conversation","/#","^Kevin: No problem. And seriously—if you find anything, let me know. I need to know I'm not going crazy.","\n",{"->":"hub"},null]}],null],"get_lockpicks":["ev",true,"/ev",{"VAR=":"given_lockpick","re":true},"#","^give_item:lockpick","/#","^Kevin: Here's the lockpick set. It's professional grade.","\n","^Kevin: Most of the older locks in the building are vulnerable. Good for testing security.","\n","^Kevin: Patricia's office has an old briefcase she left behind. You might be able to pick that open if you're curious what she was working on.","\n",{"->":"hub"},null],"get_keycard":["ev",true,"/ev",{"VAR=":"given_keycard","re":true},"#","^give_item:keycard","/#","^Kevin: Here's my server room keycard.","\n","^Kevin: The server room is through Derek's office—there's a connecting door on the east wall.","\n","^Kevin: The servers hold everything. If there's evidence of unauthorized activity, that's where you'll find it.","\n",{"->":"hub"},null],"ask_passwords":[["ev",true,"/ev",{"VAR=":"asked_about_passwords","re":true},"ev",true,"/ev",{"VAR=":"given_password_hints","re":true},"ev",{"VAR?":"influence"},1,"+",{"VAR=":"influence","re":true},"/ev","#","^give_item:notes","/#","^Kevin: Password security here is... not great.","\n","^Kevin: I enforce complexity requirements on domain accounts, but people find patterns.","\n","^Kevin: Company name plus numbers. Birthdays. Anniversary dates.","\n","^Kevin: Derek uses his birthday or anniversary in everything. April 19th. Makes his passwords easy to guess.","\n","ev","str","^0419?","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^That's useful, thanks","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","ev",{"VAR?":"influence"},2,"+",{"VAR=":"influence","re":true},"/ev","^Kevin: Yeah. I've told him it's a security risk but he doesn't listen.","\n","^Kevin: Here, I wrote down the common patterns people use. Might help with the audit.","\n",{"->":"hub"},null],"c-1":["\n",{"->":"hub"},null]}],null],"ask_about_derek":[["ev",true,"/ev",{"VAR=":"asked_about_derek","re":true},"ev",{"VAR?":"influence"},1,"+",{"VAR=":"influence","re":true},"/ev","^Kevin: Derek's been here about 18 months. Senior Marketing Manager.","\n","^Kevin: At first he seemed normal. Then he started requesting \"enhanced privacy\" for his systems.","\n","^Kevin: Wanted separate network segments, encrypted communications, locked office at all times.","\n","^Kevin: Said it was for \"client confidentiality\" but... marketing doesn't need that level of security.","\n","ev","str","^What do you think he's really doing?","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^Maybe he's just paranoid","/str","/ev",{"*":".^.c-1","flg":4},{"c-0":["\n","^Kevin: I don't know. But whatever it is, it's not marketing.","\n","^Kevin: He's been meeting with external people—calls them \"partners.\"","\n","^Kevin: I saw notes once that mentioned something called \"Operation Shatter.\"","\n","ev",{"VAR?":"influence"},2,"+",{"VAR=":"influence","re":true},"/ev",{"->":"hub"},null],"c-1":["\n","^Kevin: Maybe. But Patricia didn't think so. And now she's gone.","\n",{"->":"hub"},null]}],null],"security_audit_start":["ev",true,"/ev",{"VAR=":"security_audit_given","re":true},"#","^set_variable:security_audit_completed=true","/#","^Kevin: Oh! Yeah, I'd love to hear what you've found so far.","\n","^Kevin: I mean, you're the professional. What's your assessment of our security posture?","\n","^Player: I've been observing and testing. Let me give you some preliminary findings.","\n","^Kevin: Please, go ahead. I need to know if I'm overreacting or if we really do have problems.","\n",{"->":"audit_question_1"},null],"audit_question_1":[["ev",{"VAR?":"audit_questions_asked"},1,"+",{"VAR=":"audit_questions_asked","re":true},"/ev","^Player: First, let's talk about physical security. What would you say is the most significant concern?","\n","ev","str","^The building's physical access controls are adequate for a company this size","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^The old mechanical locks and that PIN pad on the IT room are easily bypassed","/str","/ev",{"*":".^.c-1","flg":4},"ev","str","^Physical security isn't really a priority compared to digital security","/str","/ev",{"*":".^.c-2","flg":4},{"c-0":["\n","ev",{"VAR?":"audit_wrong_answers"},1,"+",{"VAR=":"audit_wrong_answers","re":true},"/ev","^Kevin: Really? I was worried about those old door locks...","\n","^Kevin: But I guess if you think they're adequate, maybe I'm being paranoid.","\n",{"->":"audit_question_2"},null],"c-1":["\n","ev",{"VAR?":"audit_correct_answers"},1,"+",{"VAR=":"audit_correct_answers","re":true},"/ev","ev",{"VAR?":"influence"},1,"+",{"VAR=":"influence","re":true},"/ev","^Kevin: Yes! That's exactly what I've been saying!","\n","^Kevin: I requested modern electronic locks six months ago. Budget was \"under review.\"","\n","^Kevin: Anyone with basic lockpicking skills could get into most rooms here.","\n",{"->":"audit_question_2"},null],"c-2":["\n","ev",{"VAR?":"audit_wrong_answers"},1,"+",{"VAR=":"audit_wrong_answers","re":true},"/ev","^Kevin: Hmm. I thought physical access was important, but you're the expert.","\n","^Kevin: I guess I should focus more on the digital side then.","\n",{"->":"audit_question_2"},null]}],null],"audit_question_2":[["ev",{"VAR?":"audit_questions_asked"},1,"+",{"VAR=":"audit_questions_asked","re":true},"/ev","^Player: Second question—I've been reviewing the access logs. What concerns you most about the patterns?","\n","ev","str","^Everything looks normal. Standard office hours access mostly","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^Derek's credentials being used for server room access at 2 AM is a red flag","/str","/ev",{"*":".^.c-1","flg":4},"ev","str","^The access logs seem fine, but you should implement better monitoring","/str","/ev",{"*":".^.c-2","flg":4},{"c-0":["\n","ev",{"VAR?":"audit_wrong_answers"},1,"+",{"VAR=":"audit_wrong_answers","re":true},"/ev","^Kevin: But... what about those 2 AM logins to the server room?","\n","^Kevin: Maybe I'm reading too much into it.","\n",{"->":"audit_question_3"},null],"c-1":["\n","ev",{"VAR?":"audit_correct_answers"},1,"+",{"VAR=":"audit_correct_answers","re":true},"/ev","ev",{"VAR?":"influence"},1,"+",{"VAR=":"influence","re":true},"/ev","^Kevin: Thank you! I knew I wasn't crazy!","\n","^Kevin: Management keeps telling me he's just \"dedicated\" and \"works odd hours.\"","\n","^Kevin: But we don't have anything in that server room that marketing should be accessing at all.","\n",{"->":"audit_question_3"},null],"c-2":["\n","ev",{"VAR?":"audit_wrong_answers"},1,"+",{"VAR=":"audit_wrong_answers","re":true},"/ev","^Kevin: I thought the current logs were already showing problems...","\n","^Kevin: But yeah, better monitoring couldn't hurt.","\n",{"->":"audit_question_3"},null]}],null],"audit_question_3":[["ev",{"VAR?":"audit_questions_asked"},1,"+",{"VAR=":"audit_questions_asked","re":true},"/ev","^Player: Third—password security. What's your assessment of the biggest vulnerability?","\n","ev","str","^Your password complexity requirements are sufficient","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^Staff are using predictable patterns—birthdays, company name plus numbers","/str","/ev",{"*":".^.c-1","flg":4},"ev","str","^Passwords aren't the real issue—focus on multi-factor authentication instead","/str","/ev",{"*":".^.c-2","flg":4},{"c-0":["\n","ev",{"VAR?":"audit_wrong_answers"},1,"+",{"VAR=":"audit_wrong_answers","re":true},"/ev","^Kevin: I guess the requirements are technically there...","\n","^Kevin: I just worry people are finding predictable ways around them.","\n",{"->":"audit_question_4"},null],"c-1":["\n","ev",{"VAR?":"audit_correct_answers"},1,"+",{"VAR=":"audit_correct_answers","re":true},"/ev","ev",{"VAR?":"influence"},1,"+",{"VAR=":"influence","re":true},"/ev","^Kevin: Exactly! I see it all the time in password reset requests.","\n","^Kevin: \"Viral2023\" \"Viral2024\" - I've warned people but they keep doing it.","\n","^Kevin: And Derek... well, you've probably figured out his pattern by now.","\n",{"->":"audit_question_4"},null],"c-2":["\n","ev",{"VAR?":"audit_wrong_answers"},1,"+",{"VAR=":"audit_wrong_answers","re":true},"/ev","^Kevin: We don't have MFA yet—budget constraints.","\n","^Kevin: So I'm stuck with just passwords for now. Wish we could implement MFA.","\n",{"->":"audit_question_4"},null]}],null],"audit_question_4":[["ev",{"VAR?":"audit_questions_asked"},1,"+",{"VAR=":"audit_questions_asked","re":true},"/ev","^Player: Fourth—personnel security. What's the biggest red flag you see?","\n","ev","str","^The staff seem trustworthy. No major concerns","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^A manager investigating security concerns was suddenly fired—that's suspicious","/str","/ev",{"*":".^.c-1","flg":4},"ev","str","^You need better background checks and security clearances","/str","/ev",{"*":".^.c-2","flg":4},{"c-0":["\n","ev",{"VAR?":"audit_wrong_answers"},1,"+",{"VAR=":"audit_wrong_answers","re":true},"/ev","^Kevin: I want to believe that, I really do.","\n","^Kevin: But Patricia's firing still bothers me.","\n",{"->":"audit_question_5"},null],"c-1":["\n","ev",{"VAR?":"audit_correct_answers"},1,"+",{"VAR=":"audit_correct_answers","re":true},"/ev","ev",{"VAR?":"influence"},2,"+",{"VAR=":"influence","re":true},"/ev","^Kevin: Right?! That's what worries me most!","\n","^Kevin: Patricia was asking the right questions. Then she was gone.","\n","^Kevin: And nobody will tell me why. Just \"performance issues.\"","\n","^Kevin: It sends a message: don't ask questions about Derek.","\n",{"->":"audit_question_5"},null],"c-2":["\n","ev",{"VAR?":"audit_wrong_answers"},1,"+",{"VAR=":"audit_wrong_answers","re":true},"/ev","^Kevin: I mean, we do background checks for sensitive positions...","\n","^Kevin: But yeah, we could probably do better.","\n",{"->":"audit_question_5"},null]}],null],"audit_question_5":[["ev",{"VAR?":"audit_questions_asked"},1,"+",{"VAR=":"audit_questions_asked","re":true},"/ev","^Player: Finally—data protection practices. What concerns you about how sensitive data is handled here?","\n","ev","str","^Standard security practices seem to be followed adequately","/str","/ev",{"*":".^.c-0","flg":4},"ev","str","^Derek's encrypted comms and separate network segments lack business justification","/str","/ev",{"*":".^.c-1","flg":4},"ev","str","^You need better encryption across the board","/str","/ev",{"*":".^.c-2","flg":4},{"c-0":["\n","ev",{"VAR?":"audit_wrong_answers"},1,"+",{"VAR=":"audit_wrong_answers","re":true},"/ev","^Kevin: I suppose most people follow the basics...","\n","^Kevin: Though Derek's setup still seems excessive to me.","\n",{"->":"audit_complete"},null],"c-1":["\n","ev",{"VAR?":"audit_correct_answers"},1,"+",{"VAR=":"audit_correct_answers","re":true},"/ev","ev",{"VAR?":"influence"},2,"+",{"VAR=":"influence","re":true},"/ev","^Kevin: Yes! That's exactly it!","\n","^Kevin: Marketing doesn't need that level of segmentation. We're not handling credit cards or medical records.","\n","^Kevin: He claims it's for \"client confidentiality\" but I've never seen documentation justifying the architecture.","\n","^Kevin: It looks less like security and more like... hiding something.","\n",{"->":"audit_complete"},null],"c-2":["\n","ev",{"VAR?":"audit_wrong_answers"},1,"+",{"VAR=":"audit_wrong_answers","re":true},"/ev","^Kevin: We have encryption where we need it...","\n","^Kevin: Though I guess more couldn't hurt?","\n",{"->":"audit_complete"},null]}],null],"audit_complete":["^Kevin: Thank you. Seriously, thank you for taking the time to go through this with me.","\n","ev",{"VAR?":"audit_correct_answers"},4,">=","/ev",[{"->":".^.b","c":true},{"b":["\n","^Kevin: You really understand what's happening here. Everything you've flagged matches my concerns exactly.","\n","^Kevin: It's such a relief to have a professional validate what I've been seeing.","\n","^Kevin: I've felt like I'm going crazy, or being paranoid. But you see it too.","\n","ev",{"VAR?":"influence"},3,"+",{"VAR=":"influence","re":true},"/ev",{"->":".^.^.^.8"},null]}],"nop","\n","ev",{"VAR?":"audit_correct_answers"},3,"==","/ev",[{"->":".^.b","c":true},{"b":["\n","^Kevin: You've identified some key issues. A few things we see differently, but overall you're confirming my main worries.","\n","^Kevin: At least I know I'm not completely off base with my concerns.","\n","ev",{"VAR?":"influence"},2,"+",{"VAR=":"influence","re":true},"/ev",{"->":".^.^.^.16"},null]}],"nop","\n","ev",{"VAR?":"audit_correct_answers"},2,"<=","/ev",[{"->":".^.b","c":true},{"b":["\n","^Kevin: I appreciate the feedback, even if we see some things differently.","\n","^Kevin: Maybe I am being too paranoid about some of this stuff.","\n","^Kevin: But... I still can't shake the feeling something's wrong here.","\n","ev",{"VAR?":"influence"},1,"+",{"VAR=":"influence","re":true},"/ev",{"->":".^.^.^.24"},null]}],"nop","\n","^Kevin: I'm going to document your findings in my incident log.","\n","^Kevin: If management won't listen to me, maybe they'll listen to the security auditor.","\n","^Kevin: Keep investigating. And please—if you find anything concrete, tell me immediately.","\n",{"->":"hub"},null],"global decl":["ev",0,{"VAR=":"influence"},false,{"VAR=":"met_kevin"},false,{"VAR=":"discussed_audit"},false,{"VAR=":"asked_about_derek"},false,{"VAR=":"asked_about_passwords"},false,{"VAR=":"given_lockpick"},false,{"VAR=":"given_keycard"},false,{"VAR=":"given_password_hints"},false,{"VAR=":"warned_about_derek"},false,{"VAR=":"security_audit_given"},0,{"VAR=":"audit_questions_asked"},0,{"VAR=":"audit_correct_answers"},0,{"VAR=":"audit_wrong_answers"},"/ev","end",null]}],"listDefs":{}}
\ No newline at end of file