From 6f57e37a4de9c52c32c2b1040decb844ff124f52 Mon Sep 17 00:00:00 2001
From: "Z. Cliffe Schreuders" <code.cliffe@schreuders.org>
Date: Wed, 14 Jan 2026 09:46:32 +0000
Subject: [PATCH] Add Mission 3 Stage 6 LORE fragments (Part 2: Fragment 2 -
 EVIDENCE)

- LORE Fragment 2: Q3 2024 Exploit Catalog (195 words)
- PRIMARY EVIDENCE document with specific harm calculations
- ProFTPD exploit: $12,500 (base $9,615 + 30% healthcare premium)
- M2 hospital connection explicitly documented
- Sector premium system (+30% healthcare, +40% energy)
- Architect directive: "Healthcare infrastructure Phase 1"
- Q3 revenue: $847,000 (23 exploits sold)
- Variable tracking: found_exploit_catalog

Next: Fragment 3 (Architect's Directive - future attack plans)
---
 .../stages/stage_6/lore_fragments.md          | 105 +++++++++++++++++-
 1 file changed, 103 insertions(+), 2 deletions(-)

diff --git a/planning_notes/overall_story_plan/mission_initializations/m03_ghost_in_the_machine/stages/stage_6/lore_fragments.md b/planning_notes/overall_story_plan/mission_initializations/m03_ghost_in_the_machine/stages/stage_6/lore_fragments.md
index bf11e5a..13be8d5 100644
--- a/planning_notes/overall_story_plan/mission_initializations/m03_ghost_in_the_machine/stages/stage_6/lore_fragments.md
+++ b/planning_notes/overall_story_plan/mission_initializations/m03_ghost_in_the_machine/stages/stage_6/lore_fragments.md
@@ -98,5 +98,106 @@ MOTTO: "Security Through Economics"
 
 ---
 
-**Status:** 🔄 IN PROGRESS (Part 1/3 - Fragment 1 complete)
-**Next:** LORE Fragment 2 (Q3 2024 Exploit Catalog - EVIDENCE)
+## LORE Fragment 2: Q3 2024 Exploit Catalog (EVIDENCE DOCUMENT)
+
+**ID:** `lore_fragment_2`
+**Category:** Evidence / Operational Document
+**Type:** Sales Catalog with Pricing
+**Length:** 195 words
+**Discovery Location:** Server Room - Wall Safe (PIN: 2010)
+**Difficulty:** Easy-Medium (PIN clue visible in reception, safe in accessible room)
+
+### Content
+
+```
+═══════════════════════════════════════════════════════
+ZERO DAY SYNDICATE - Q3 2024 EXPLOIT CATALOG
+Classification: ENTROPY EYES ONLY
+Authorized Buyers: Ransomware Incorporated, Critical Mass,
+                  Social Fabric, Ghost, Dark Pattern
+═══════════════════════════════════════════════════════
+
+PRICING STRUCTURE (Base Rates):
+
+CRITICAL SEVERITY (CVSS 9.0-10.0):
+- Remote Code Execution: $35,000
+- Privilege Escalation (Root): $28,000
+- Authentication Bypass: $22,000
+
+HIGH SEVERITY (CVSS 7.0-8.9):
+- SQL Injection (admin access): $18,000
+- File Upload (webshell): $15,000
+- Deserialization RCE: $20,000
+
+MEDIUM SEVERITY (CVSS 4.0-6.9):
+- XSS (stored): $7,500
+- CSRF (privileged actions): $6,000
+
+SECTOR TARGETING PREMIUMS:
++30% Healthcare (delayed incident response)
++40% Energy/Infrastructure (regulatory scrutiny delays)
++25% Finance (insurance/recovery budgets)
++15% Education (limited security resources)
+
+───────────────────────────────────────────────────────
+Q3 2024 SALES RECORD:
+
+ProFTPD 1.3.5 Backdoor Exploit (CVE-2010-4652)
+├─ Base Price: $9,615 (HIGH severity)
+├─ Healthcare Premium: +30% ($2,885)
+└─ FINAL PRICE: $12,500
+
+BUYER: GHOST (Ransomware Incorporated)
+TARGET: St. Catherine's Regional Medical Center
+PAYMENT: Received 2024-05-15
+STATUS: Delivered
+
+Buyer Note: "Perfect for hospital networks. Confirmed
+vulnerable on reconnaissance. Patient data + ransom
+potential = high ROI."
+
+Cipher Authorization: APPROVED
+Architect Directive: PRIORITY - Healthcare infrastructure
+                     Phase 1
+───────────────────────────────────────────────────────
+
+TOTAL Q3 REVENUE: $847,000 (23 exploits sold)
+PROJECTED Q4: $1.2M+ (infrastructure focus Phase 2)
+```
+
+### Design Notes
+
+**Narrative Function:**
+- **EVIDENCE OF CALCULATED HARM:** Shows exact price ($12,500) for exploit that killed hospital patients
+- **REVEALS M2 CONNECTION:** ProFTPD exploit explicitly listed as sold to GHOST for St. Catherine's attack
+- **SHOWS TARGETING PREMIUMS:** Healthcare sector charged 30% more because of "delayed incident response" (cynical calculation)
+- **INTRODUCES THE ARCHITECT:** Direct reference to Architect coordination ("Priority - Healthcare infrastructure Phase 1")
+- **PROVES PREMEDITATION:** Buyer note shows they knew target, Victoria/Cipher approved anyway
+
+**Voice:** Business-clinical, pricing catalog format, emotionless transaction records
+
+**Player Value:**
+- **SMOKING GUN EVIDENCE:** Direct proof Zero Day sold M2 hospital exploit
+- Specific financial details ($12,500, $847K Q3 revenue)
+- Shows sector premium system (charges more for vulnerable targets)
+- First mention of "The Architect" coordinating attacks across cells
+- **Emotional Impact:** Reading "Healthcare Premium: +30%" next to hospital deaths is chilling
+
+**Evidence Quality:** ⭐⭐⭐ PRIMARY EVIDENCE - Direct link to M2 casualties, specific pricing, approval chain
+
+**Variable on Discovery:** `found_exploit_catalog = true`
+
+**Debrief Acknowledgment:**
+```ink
+{found_exploit_catalog:
+    Agent 0x99: The exploit catalog... that's the smoking gun.
+    Agent 0x99: $12,500. That's what they charged for the hospital attack that killed six people.
+    Agent 0x99: And the "healthcare premium"? They charge MORE when targets can't defend themselves.
+    Agent 0x99: [Pause] This isn't hacking. It's murder for profit.
+}
+```
+
+---
+
+**Status:** 🔄 IN PROGRESS (Part 2/3 - Fragments 1-2 complete)
+**Next:** LORE Fragment 3 (The Architect's Directive - EVIDENCE)