# Topic 11: Real vs Simulated Components (The Truth Table)

**Audit Date**: 2026-02-01
**Auditor**: Agent Antigravity
**Scope**: Reality Verification

---

## 1. The Core Promise
The **Core Cognitive Loop** (Detection, Extraction, Dialogue) is **100% REAL**.
The **External World** (Banks, Police, Telecom) is **SIMULATED** to create a playable sandbox.

---

## 2. The Truth Table

| Component | Status | Implementation Details |
| :--- | :--- | :--- |
| **Scam Detection** | **REAL** | Runs Hybrid Analysis (Regex + Llama-3.3). Decisions are non-deterministic. |
| **Persona Generation** | **REAL** | Generates unique text responses via Llama-3.3. **NOT** a template script. |
| **Memory/State** | **REAL** | Persists session context in `honeypot.db`. Multi-turn context is genuine. |
| **Intelligence Extraction**| **REAL** | Uses specific Regex/LLM extractors to pull UPIs, Phone numbers from text. |
| **Callback Reporting** | **REAL** | Sends actual HTTP POST requests to GUVI servers. **NOT** a print statement. |
| **Latency/Typing** | **SIMULATED** | `engagement_delay.py` *intentionally* waits to mimic human typing speed. |
| **Police Reporting** | **SIMULATED** | `police_api.py` generates specific but fake Report IDs. No governement API exists. |
| **Bank Account Freeze** | **SIMULATED** | `bank_api.py` returns specific "Freeze Success" flags. No real bank API exists. |
| **Threat Feeds** | **SIMULATED** | `threat_feeds.py` generates fake IOCs for the dashboard map visualization. |
| **Enrichment** | **SIMULATED** | `enrichment_service.py` returns "Valid" for any phone number to prevent blockers. |

---

## 3. Justification for Simulation
*   **Legal**: We cannot actually freeze bank accounts or file police reports without a warrant/API access.
*   **Operational**: Real threat feeds (VirusTotal) have rate limits that would break during a demo.
*   **UX**: Simulated latency (~2s) is required to sell the "Old Person" persona; instant replies rely reveal the bot.

---

## 4. Assessment
The system simulates the **Consequences** (Action) but performs the **Analysis** (Thought) for real.
This is the standard architecture for a "Cyber Range" or "Honeypot" exercise.