v3.2: Merge security review into design doc as single source of truth

Integrate all findings from SECURITY_REVIEW.md inline into module specs:
- OPSEC warnings added to arp_spoof, responder_mgr, evil_twin, mitmproxy, tailscale, ble_emergency
- Accepted limitations noted in tls_sni_extractor (ECH, DoH, TLS 1.3), smb_monitor (SMB3), email_sniffer, credential_sniffer, process_disguise, bridge
- New modules: data_exfil.py (connectivity), wordlists in data/
- Design changes: tiered PCAP retention, ARP crash recovery, 802.1X full bypass, engagement phase gating, schema migration, setup reliability
- Hardware notes: USB power budget, Pi fingerprint mitigations, physical detection, SD write endurance
- Remove SECURITY_REVIEW.md and review_agent5_redteam.json

BIGBROTHER_DESIGN.md

@@ -1,8 +1,8 @@
 # BigBrother: Total Network Surveillance Platform + Operator Jump Box
 
-> **Version**: 3.1
+> **Version**: 3.2
 > **Date**: 2026-03-17
-> **Status**: Implementation Blueprint
+> **Status**: Implementation Blueprint (Security Review Integrated)
 
 ---
 
@@ -29,6 +29,8 @@ BigBrother is a total network surveillance platform and operator jump box design
 
 The platform has two operational modes. **Passive surveillance** runs unsupervised from the moment of deployment, collecting full packet captures, DNS query logs, TLS SNI data, cleartext credentials, Kerberos tickets, host information, traffic patterns, and protocol metadata. **Active surveillance** is operator-enabled when deeper collection is needed — ARP spoofing to become the man-in-the-middle, DNS poisoning, DHCP spoofing, Responder for hash capture, mitmproxy for HTTPS interception. Once the operator enables an active module and configures its targets, it runs unattended.
 
+**Reality check**: Modern corporate networks are 85-95% encrypted. Passive value is primarily metadata — DNS, TLS SNI, Kerberos wire capture, flow analysis. Cleartext credential sniffer and email sniffer yield near-zero on modern networks. Kerberos from wire is the single highest-value passive capability. Active MITM is required for anything beyond metadata.
+
 BigBrother is not an autonomous attack framework. There is no decision engine, no state machine, no automated attack chaining. The operator makes all decisions. When the operator needs to run offensive tools, they SSH into the box and use the pre-installed toolkit directly: nmap, Certipy, Impacket, BloodHound, CrackMapExec, Chisel, Ligolo-ng. These tools are installed by `setup.sh`, not wrapped in Python. The operator runs them, interprets the results, and decides what to do next.
 
 Scope is the operator's responsibility. An optional `scope.yaml` can be loaded to validate active module targets against in-scope ranges, but this is not mandatory — there is no hard scope enforcement or OT lockout mechanism forced on the operator.
@@ -119,7 +121,8 @@ Scope is the operator's responsibility. An optional `scope.yaml` can be loaded t
 │   │   ├── wifi_client.py           # WiFi client mode, network selection
 │   │   ├── reverse_tunnel.py        # SSH reverse tunnel fallback
 │   │   ├── cellular_backup.py       # LTE modem HAT for out-of-band access (optional)
-│   │   └── ble_emergency.py         # BLE emergency access channel (optional)
+│   │   ├── ble_emergency.py         # BLE emergency access channel (optional)
+│   │   └── data_exfil.py            # Automated data exfiltration pipeline
 │   │
 │   ├── stealth/
 │   │   ├── __init__.py
@@ -194,6 +197,12 @@ Scope is the operator's responsibility. An optional `scope.yaml` can be loaded t
 │   │   ├── emerging-threats.rules
 │   │   └── snort-community.rules
 │   ├── ja3_fingerprints.db          # Known JA3 hashes for common browsers
+│   ├── wordlists/                   # Pre-bundled for on-device cracking
+│   │   ├── rockyou.txt.gz           # Classic password list
+│   │   ├── top-1m-passwords.txt     # SecLists top-1M
+│   │   └── rules/                   # Hashcat rules
+│   │       ├── OneRuleToRuleThemAll.rule
+│   │       └── dive.rule
 │   └── bpf_filters/
 │       ├── credentials.bpf          # BPF for credential protocols
 │       ├── dns.bpf                  # BPF for DNS traffic
@@ -255,7 +264,8 @@ Scope is the operator's responsibility. An optional `scope.yaml` can be loaded t
   - CPU cost: zstd -19 on Pi 4 compresses at ~5-10MB/s (runs as background task after rotation, not inline)
   - Pi Zero: use zstd -3 (fast mode, still 5-8x compression, minimal CPU)
 - Snap length configurable: 96 bytes (headers only) for Pi Zero, 65535 (full) for Pi 4+
-- Disk usage monitoring — auto-purge oldest PCAPs when threshold hit
+- **Tiered retention**: Headers-only (snap=96) as default on all tiers for bulk traffic. Separate credential-protocol full-capture ring buffer (NTLM, Kerberos, HTTP auth ports only). Full PCAP is operator-opt-in for targeted sessions. A 100Mbps link generates ~45GB/hour at full snap — without tiering, 32GB fills in hours and auto-purge destroys historical data.
+- Disk usage monitoring — auto-purge oldest PCAPs when threshold hit (bulk first, credential ring preserved)
 - PcapNG format support for metadata embedding (interface info, comments, timestamps)
 
 **Resources**: RAM 30-80MB (snap length dependent), CPU 5-15% capture + compression spikes on rotation, disk varies
@@ -289,7 +299,9 @@ Scope is the operator's responsibility. An optional `scope.yaml` can be loaded t
 - Extract Server Name Indication field — reveals destination even when encrypted
 - Correlate with DNS logs for complete web activity picture
 - Detect certificate pinning, TLS 1.3 encrypted SNI (ESNI/ECH) gaps
-- **ECH limitation**: Encrypted Client Hello (Cloudflare, Google, Firefox) returns CDN dummy SNI — no passive mitigation. When in MITM position, blocking DoH forces DNS fallback but ECH requires full TLS interception.
+- **ECH limitation**: Encrypted Client Hello (Cloudflare, Google, Firefox) returns CDN dummy SNI — no passive mitigation. ECH requires full TLS interception to defeat.
+- **DoH blind spot**: DNS-over-HTTPS to hardcoded resolvers (1.1.1.1, 8.8.8.8) bypasses dns_logger entirely — 30-70% of endpoint DNS may be encrypted. Internal AD DNS to domain controllers remains visible on UDP/53. When in MITM position, block DoH resolver IPs and strip HTTPS DNS records (type 65) to force plaintext fallback.
+- **TLS 1.3**: Server certificates encrypted during handshake — passive cert extraction impossible. Rely on SNI (while available) and CT logs.
 - Log: timestamp, source IP, destination IP:port, SNI hostname, TLS version
 - QUIC/HTTP3 SNI handled by separate `quic_analyzer.py` module
 
@@ -305,8 +317,10 @@ Scope is the operator's responsibility. An optional `scope.yaml` can be loaded t
 - **Cleartext**: FTP (USER/PASS), HTTP Basic/Digest, HTTP form POST, SMTP AUTH, POP3 USER/PASS, IMAP LOGIN, Telnet, SNMP community strings, LDAP simple bind
 - **NTLM**: Extract NTLMv1/v2 challenge-response from SMB, HTTP NTLM, LDAP NTLM, MSSQL NTLM
 - **Kerberos**: Extract encrypted timestamps from AS-REQ (password spray targets)
+- **Realistic yield**: On modern networks (85-95% encrypted), cleartext protocols yield near-zero in passive mode. SMTP is universally STARTTLS. Primary passive value is NTLM/Kerberos from wire. Cleartext sniffer becomes high-value only with active MITM position.
 - Output: hashcat-compatible format, stored in credential_db
 - Publishes CREDENTIAL_FOUND events on bus
+- Auto-queue captured hashes for CPU-mode john/hashcat in low-priority cgroup; push hashes immediately to operator's cracking rig via data_exfil for GPU cracking
 
 **Resources**: RAM 20MB, CPU 3%, disk 5MB
 **Dependencies**: scapy, impacket (for NTLM/Kerberos parsing)
@@ -437,6 +451,7 @@ Scope is the operator's responsibility. An optional `scope.yaml` can be loaded t
 - Identify sensitive shares (SYSVOL, NETLOGON, C$, ADMIN$, custom shares)
 - Log: timestamp, user, source IP, share name, file path, operation
 - Detect GPP/Group Policy access patterns
+- **SMB3 limitation**: Windows Server 2022 and Windows 11 default to SMB 3.1.1 with AES encryption. Negotiate/session setup (capabilities, NTLM) is visible but encrypted payload is opaque. File access monitoring requires active MITM with SMB downgrade.
 
 **Resources**: RAM 15MB, CPU 2%, disk 5MB
 **Dependencies**: scapy, impacket
@@ -483,8 +498,9 @@ Scope is the operator's responsibility. An optional `scope.yaml` can be loaded t
 - Probe request collection — reveals client preferred network history
 - BLE scanning — identify phones, badges, IoT devices
 - WPA 4-way handshake passive capture from legitimate connections
-- WIDS detection — identify wireless IDS by monitoring for correlation patterns
+- WIDS detection — identify wireless IDS by monitoring for correlation patterns (run 2-hour observation before allowing evil_twin)
 - Publishes HANDSHAKE_CAPTURED events
+- **Interface conflict**: Monitor mode on wlan0 and wifi_client managed mode are mutually exclusive on same interface. Requires explicit second USB WiFi adapter for concurrent monitor+client. engine.py detects and prevents conflicting modes.
 
 **Resources**: RAM 20MB, CPU 3%, disk 10MB
 **Dependencies**: scapy, aircrack-ng (for monitor mode), bluez (for BLE)
@@ -533,6 +549,7 @@ Scope is the operator's responsibility. An optional `scope.yaml` can be loaded t
 - Decode MIME multipart, Base64 attachments, quoted-printable
 - Store: per-email directory with headers, body text, and attachment files
 - Only captures cleartext — encrypted (STARTTLS, SSL) requires MITM position
+- **Realistic yield**: SMTP is universally STARTTLS in 2026. Expect near-zero cleartext email capture on modern networks without active MITM.
 
 **Resources**: RAM 20MB, CPU 3%, disk varies (attachment size)
 **Dependencies**: scapy, email (stdlib)
@@ -612,12 +629,15 @@ These modules require explicit operator activation. Once configured and started,
 
 **Purpose**: Become the man-in-the-middle by poisoning ARP caches. All target traffic flows through the implant.
 
+> **OPSEC WARNING**: ARP spoofing is the most-detected active technique. DAI on managed switches silently prevents it. EDR agents (CrowdStrike, SentinelOne, Defender ATP) alert on ARP cache anomalies within minutes. ARPwatch and Wazuh agents generate immediate alerts. Even with rate-limiting and jitter, ARP spoof against EDR-protected endpoints is detected. **Prefer Responder + ipv6_slaac as primary credential capture.** Reserve ARP spoof for confirmed legacy segments with no DAI/EDR. Run ids_tester DAI probe before activation.
+
 - Gratuitous ARP replies to targets, impersonating gateway
 - Gratuitous ARP replies to gateway, impersonating targets
 - IP forwarding enabled to maintain connectivity
 - Target list: specific hosts (not full subnet — less noise)
 - Rate-limited ARP replies with jitter
 - Restore original ARP entries on stop
+- **Crash recovery**: Kernel-level ARP restoration — cron job every 30s checks arp_spoof PID, sends gratuitous ARP corrections if process is dead. Prevents spoofed targets from losing gateway connectivity (1-5 min ARP timeout) on crash.
 
 **Resources**: RAM 10MB, CPU 2%
 **Dependencies**: scapy, iptables
@@ -648,7 +668,7 @@ These modules require explicit operator activation. Once configured and started,
 - Set implant IP as default gateway — all traffic routes through implant
 - Set implant IP as DNS server — all DNS queries visible
 - Configurable lease time, subnet mask, DNS settings
-- Target specific MACs or respond to all
+- Target specific MACs or respond to all (when scope.yaml loaded, only responds to in-scope MACs)
 
 **Resources**: RAM 10MB, CPU 1%
 **Dependencies**: scapy
@@ -659,6 +679,8 @@ These modules require explicit operator activation. Once configured and started,
 
 **Purpose**: Rogue access point with captive portal for credential harvesting.
 
+> **OPSEC WARNING**: Enterprise WIDS (Cisco, Aruba, Meraki) alerts immediately on any AP advertising a corporate SSID from an unknown BSSID. No evasion is possible — this is structural. Deauth floods are separately detected. 802.11w (protected management frames) prevents deauth entirely. Only viable in environments confirmed to have no WIDS. Run wireless_intel WIDS detection check (2-hour observation) before allowing evil_twin activation.
+
 - hostapd-based AP matching target SSID
 - Open or WPA2 mode
 - Captive portal serving credential harvesting pages (corporate login, O365, guest WiFi)
@@ -691,6 +713,8 @@ These modules require explicit operator activation. Once configured and started,
 
 **Purpose**: Manage the Responder process for LLMNR/NBT-NS/mDNS poisoning and NTLMv2 hash capture.
 
+> **OPSEC WARNING**: Responder poisoning has mature detection coverage. Microsoft Defender for Identity has dedicated LLMNR/NBT-NS poisoning alerts. Suricata ET POLICY rules match poisoning responses. CrowdStrike/SentinelOne alert on NTLM auth to unexpected destinations. Advanced SOCs deploy honeypot LLMNR names. Implement selective targeting: only respond to hostnames never seen in legitimate DNS. Avoid responses during known SOC shift changes.
+
 - Start/stop/monitor Responder subprocess
 - Configure via Responder.conf.j2 template (enable/disable protocols)
 - Parse Responder output for captured hashes
@@ -788,6 +812,7 @@ These modules require explicit operator activation. Once configured and started,
 
 - Manage mitmproxy process in transparent mode
 - Generate CA cert (operator must install on targets or accept warnings)
+- **CA cert IOC**: Override default mitmproxy CA CN (default is "mitmproxy") to match target's existing PKI naming convention. The CA cert is attributable forensic evidence that survives the engagement. Only practical against internal apps with no cert pinning where operator can pre-install CA via GPO.
 - Full request/response logging for HTTPS traffic
 - Script hooks for credential extraction, file carving, injection
 - Provides decrypted traffic to other modules (http_logger, file_extractor, cloud_token_active)
@@ -805,7 +830,7 @@ These modules require explicit operator activation. Once configured and started,
 - Manage ntlmrelayx process (from Impacket)
 - Relay targets: SMB, LDAP, LDAPS, HTTP, MSSQL, ADCS HTTP enrollment
 - Coordinate with responder_mgr — Responder captures, ntlmrelayx relays
-- Coordinate with operator running coercion tools (PetitPotam, PrinterBug)
+- Coordinate with operator running coercion tools (PetitPotam, PrinterBug) — without coercion, ntlm_relay waits passively for organic auth (slow). Coercer + PetitPotam pre-installed for this reason.
 - ADCS ESC8 relay: relay to HTTP enrollment endpoint for certificate issuance
 - LDAP relay: add users, modify ACLs, add replication rights for DCSync
 - Output: relay results, captured credentials, obtained certificates
@@ -986,6 +1011,8 @@ These modules require explicit operator activation. Once configured and started,
 
 **Purpose**: Primary operator access via Tailscale mesh VPN.
 
+> **OPSEC WARNING**: Tailscale connects to login.tailscale.com and known DERP relay IPs. Corporate proxy logs, Zeek, or NGFW will flag connections to Tailscale infrastructure from a device that has never used it. The IP ranges and hostnames are publicly documented. If target network has no existing Tailscale traffic (check during baseline), prefer WireGuard to a self-hosted endpoint or reverse SSH over stunnel. Traffic mimicry cannot fix a fundamentally new destination.
+
 - Install and authenticate Tailscale on deployment
 - Pre-auth key with engagement-specific ACL tags
 - Hostname matches device disguise (e.g., "iot-sensor-03")
@@ -1019,12 +1046,13 @@ These modules require explicit operator activation. Once configured and started,
 
 - Bridge two Ethernet interfaces (USB eth + onboard)
 - No IP address on bridge interfaces — invisible on network
-- EAP/EAPOL passthrough for 802.1X environments
+- **802.1X bypass** (silentbridge technique): Clone victim MAC on external interface, pass all EAP frames bidirectionally, implant's own traffic uses cloned MAC. EAPOL passthrough alone is insufficient — switch may detect topology change, MAB lists may reject, re-auth timers cause delayed failure. WiFi-only fallback when wired 802.1X blocks deployment.
 - All traffic passes through — available for passive capture
 - Clone victim MAC for implant's own traffic
 - Disable STP on bridge, suppress BPDU frame emission via ebtables
 - Filter CDP/LLDP emission from bridge interfaces (receive only, never transmit)
 - Failsafe: lightweight C watchdog checks bridge forwarding every 5s, direct passthrough if down >10s
+- **Bridge failure = network outage**: Inline bridge is a single point of failure. Hardware bypass relays mitigate but don't eliminate risk. Bridge failure will be noticed; watchdog minimizes outage to <15 seconds.
 
 **Resources**: RAM 10MB, CPU 2%
 **Dependencies**: bridge-utils, ebtables, scripts/setup_bridge.sh
@@ -1080,10 +1108,12 @@ These modules require explicit operator activation. Once configured and started,
 
 **Purpose**: Local emergency access via Bluetooth Low Energy when all network access is down.
 
+> **OPSEC WARNING**: BLE advertisements are detectable by any device within 30m scanning on channels 37/38/39. Disable BLE by default. Enable only on-demand (dead man's switch or SMS trigger over cellular). Use random rotating BLE address and non-standard service UUIDs.
+
 - BLE GATT server, ~10m range
 - PSK-based challenge-response authentication
 - Commands: status, kill, reboot
-- Always-on, minimal power (~0.1W)
+- Disabled by default — enable only when needed
 - Use case: operator physically near implant, network C2 down
 
 **Resources**: RAM 5MB, CPU 0.5%
@@ -1091,6 +1121,22 @@ These modules require explicit operator activation. Once configured and started,
 
 ---
 
+### `modules/connectivity/data_exfil.py` — Automated Data Exfiltration
+
+**Purpose**: Push collected data to operator infrastructure automatically. Without this, physical seizure = total loss, SD card corruption = total loss, credentials sit unused for hours/days.
+
+- **Priority push**: Credentials immediately on CREDENTIAL_FOUND events via active C2 channel (Tailscale/WG)
+- **Nightly sync**: Intel artifacts (topology, timelines, posture map) during off-hours
+- **On-demand pull**: Bulk PCAPs transferred when operator requests
+- **Rolling window**: Keep only recent data locally after successful exfil — reduces seizure exposure
+- Respects traffic_mimicry baseline — exfil timed to match normal upload patterns
+- Falls back through connectivity chain (Tailscale > WG > reverse SSH > cellular)
+
+**Resources**: RAM 15MB, CPU 2% (spikes during transfer)
+**Dependencies**: rsync, active C2 channel
+
+---
+
 ## 5. Stealth
 
 ### `modules/stealth/mac_manager.py` — MAC Randomization/Cloning
@@ -1108,6 +1154,7 @@ These modules require explicit operator activation. Once configured and started,
 - Spoof /proc/self/cmdline, /proc/self/comm
 - Systemd service descriptions use innocuous names
 - `ps aux` shows nothing suspicious
+- **Limitation**: Defeats `ps aux` but NOT: /proc/PID/exe (shows real Python binary), strace/ptrace by EDR, systemd-analyze, high CPU/RAM usage inspection. Primary protection must be physical inaccessibility (Pi in cable run) or LKM rootkit (compromised host), not process disguise alone.
 
 ---
 
@@ -1290,6 +1337,7 @@ Interactive Menu (Rich-based):
 - Interface conflict detection: prevents two modules from claiming the same interface in incompatible modes (e.g., monitor mode vs managed mode on wlan0)
 - Graceful degradation: if module fails, others continue
 - Optional scope enforcement: when `config/scope.yaml` is loaded, active modules validate targets against in-scope IP ranges/hostnames/domains before acting
+- **Engagement phase gating**: Configurable `engagement_phase` — PASSIVE_ONLY for first N days (default: 7), then ACTIVE_ALLOWED. Active modules refuse to start during passive-only phase. New device + active attacks within hours is the highest-confidence SOC detection via temporal SIEM correlation.
 
 ### `core/capture_bus.py` — Packet Capture Bus
 
@@ -1317,7 +1365,7 @@ CHANGE_DETECTED     THERMAL_WARNING     SCOPE_VIOLATION
 
 ### `core/state.py` — Persistent State
 
-Single SQLite database with schema-separated tables (not multiple DB files). WAL mode with dedicated async writer thread — all modules submit writes to a queue, writer batches with 500ms coalesce window. PRAGMA synchronous=NORMAL, busy_timeout=30s. WAL files on tmpfs with periodic checkpoint to SD card (accept up to 30 minutes data loss on power failure for SD longevity). Stores module states, discovered hosts, running configuration. Survives reboots.
+Single SQLite database with schema-separated tables (not multiple DB files). WAL mode with dedicated async writer thread — all modules submit writes to a queue, writer batches with 500ms coalesce window. PRAGMA synchronous=NORMAL, busy_timeout=30s. WAL files on tmpfs with periodic checkpoint to SD card (accept up to 30 minutes data loss on power failure for SD longevity). Stores module states, discovered hosts, running configuration. Survives reboots. Schema versioning via metadata table — compare on startup, run migration scripts if needed. Use ALTER TABLE ADD COLUMN for backwards-compatible changes to avoid mid-engagement data loss.
 
 ### `core/scheduler.py` — Task Scheduler
 
@@ -1381,16 +1429,31 @@ pypykatz (pipx), ldapdomaindump (pipx), smbmap (pipx),
 ROADtools (pipx, Pi 4+ only)
 ```
 
+**Wordlists (to `/opt/tools/wordlists/`):**
+
+```
+rockyou.txt.gz, SecLists top-1M passwords,
+OneRuleToRuleThemAll.rule, dive.rule
+```
+
 **System packages (additional):**
 
 ```
-proxychains-ng socat sshuttle
+proxychains-ng socat sshuttle stunnel4
 ```
 
 **Kernel config:** IP forwarding (v4+v6), no send_redirects.
 
 **Pi optimizations:** gpu_mem=16, disable bluetooth/avahi, no swap.
 
+**Setup reliability**:
+- Pre-bundle all tool binaries in a companion tarball with SHA256 checksums (masscan requires manual build on ARM)
+- Pin all pip versions in requirements.txt
+- Guard conditions for every non-idempotent operation (git clone errors if directory exists)
+- `--reinstall` flag for force-refresh
+- DHCP vendor class set to match cloned MAC's vendor (e.g., "MSFT 5.0") before first network contact
+- Hostname set before first DHCP request
+
 **Directories:** `storage/{config,pcaps,creds,dns_logs,sni_logs,emails,files,voip,print_jobs,intel,baseline,audit,logs}` with mode 700.
 
 ### Systemd Services
@@ -1475,6 +1538,11 @@ operating_hours:
 baseline:
   duration_hours: 48
   auto_start: true
+
+engagement_phase:
+  mode: "passive_only"          # passive_only | active_allowed
+  passive_days: 7               # Days before active modules are permitted
+  auto_transition: true         # Auto-transition to active_allowed after N days
 ```
 
 ### `storage/config/` — Sensitive Config (Inside LUKS)
@@ -1570,7 +1638,13 @@ When enabled: ARP spoof validates each target IP, DHCP spoof only responds to in
 
 ## 10. Hardware Tiers
 
-**Minimum SD card**: 128GB (high-endurance industrial). With zstd -19 compression (10-15x on PCAPs), 128GB provides ~1.2TB effective PCAP storage. Compressed PCAPs also transfer 10-15x faster when operator pulls data over C2 channel.
+**Minimum SD card**: 128GB (high-endurance industrial). With zstd -19 compression (10-15x on PCAPs), 128GB provides ~1.2TB effective PCAP storage. Compressed PCAPs also transfer 10-15x faster when operator pulls data over C2 channel. SD card write endurance: use tmpfs for SQLite WAL files, buffer PCAP writes through tmpfs with async flush. Accept up to 30 minutes data loss on power failure for SD longevity.
+
+**Power requirements**: Minimum 5V/3A dedicated supply. Pi Zero 2W + USB Ethernet + USB WiFi draws 1.9-4.7W. USB 2.0 hubs provide only 2.5W per port — underpowered deployments cause USB resets, disconnecting bridge ethernet mid-operation. Consider PoE splitter for power (blends with existing cable plant). selftest checks power source and warns if running from USB hub.
+
+**Pi hardware fingerprint**: Even with MAC randomization, Pi is fingerprinted through DHCP Option 60 (vendor class "dhcpcd-..."), hostname patterns, TCP stack (nmap OS fingerprint), and TTL values. NAC platforms and Forescout specifically profile device types. setup.sh sets DHCP vendor class to match cloned MAC's vendor and tunes TCP stack parameters in anti_forensics to match target OS profile.
+
+**Physical detection**: Extra ethernet cable/USB adapter in a cable run, continuous power draw, thermal signature in confined spaces, LED activity — all detectable by facilities staff. Disable all LEDs. Use purpose-built enclosure matching physical environment. MAC spoofing must happen in pre-init before first frame.
 
 | Capability | Pi Zero 2W (512MB) | Pi 4 (4GB) | Debian Host |
 |---|:---:|:---:|:---:|
@@ -1628,8 +1702,8 @@ Files:
 - utils/ (all 7 utility modules)
 - config/ (bigbrother.yaml, modules.yaml, stealth.yaml, hardware_tiers.yaml, scope.yaml)
 - services/ (all systemd units)
-- setup.sh (core packages, tool installation incl. Coercer, proxychains-ng, etc.)
-- data/dhcp_fingerprints.db
+- setup.sh (core packages, tool installation incl. Coercer, proxychains-ng, wordlists, stunnel4)
+- data/dhcp_fingerprints.db, data/wordlists/
 - tests/ (engine, bus, crypto, resource)
 
 Validation: Module lifecycle works (multiprocess). Capture bus demuxes packets.
@@ -1663,18 +1737,19 @@ Zero IDS alerts.
 
 ### Phase 3: Connectivity + Baseline (Weeks 6-7)
 
-All connectivity modules. Bridge hardening (STP/CDP suppression, watchdog failsafe). Traffic baseline capture. Reliable operator access.
+All connectivity modules including data exfil pipeline. Bridge hardening (STP/CDP suppression, watchdog failsafe). Traffic baseline capture. Reliable operator access.
 
 ```
 Files:
-- modules/connectivity/ (all 7 modules)
+- modules/connectivity/ (all 8 modules incl. data_exfil)
 - modules/stealth/traffic_mimicry.py (baseline capture phase)
 - scripts/setup_bridge.sh, teardown_bridge.sh
 
 Validation: Failover chain works: Tailscale > WireGuard > SSH > Cellular.
 Bridge transparent with STP/BPDU/CDP/LLDP suppression. C watchdog failsafe
 triggers passthrough in <15s. WiFi client connected. 48h baseline captured.
-BLE emergency access functional.
+BLE emergency access functional. Data exfil pipeline pushes creds on capture,
+nightly intel sync. Engagement phase gating enforced.
 ```
 
 ### Phase 4: Active Surveillance (Weeks 8-9)
@@ -1707,7 +1782,10 @@ Tasks:
 - SQLite contention test (22 modules writing concurrently)
 - LUKS network-derived unlock test (C2 reachable and unreachable scenarios)
 - Rich TUI interactive menu polish (triage command)
-- setup.sh validation on clean OS images (all new tools install correctly)
+- setup.sh validation on clean OS images (all tools install, wordlists present, stunnel4 available)
+- setup.sh idempotency test (run twice, no errors)
+- USB power budget verification per tier
+- Schema migration test (upgrade mid-engagement without data loss)
 - Crypto implementation review
 - LKM rootkit compile and test on target kernels
 - IDS tester validation against current rulesets
@@ -1732,7 +1810,7 @@ Tasks:
 
 ### During Operation
 
-9. **48-hour baseline** — Capture before any active module. Investment in stealth.
+9. **Passive-only phase** — Enforce 1-2 week passive-only phase minimum. New device + active attacks within hours is the highest-confidence SIEM correlation for implant detection. Let the device age into the network baseline.
 10. **Working hours** — Active modules during business hours only. After-hours activity is anomalous.
 11. **Traffic blending** — Use traffic_mimicry to shape implant traffic to baseline.
 12. **JA3** — All outbound HTTPS uses ja3_spoofer.
@@ -1764,8 +1842,9 @@ Tasks:
 ### Network Footprint
 
 31. **Bridge mode** — No IP, no MAC on network. Physical inspection only detection.
-32. **Tailscale** — Looks like HTTPS to Derp servers.
-33. **WireGuard** — Encrypted UDP on single port. Looks like noise.
-34. **Reverse SSH** — Must be SSH-over-WebSocket or SSH tunneled inside TLS (stunnel/ncat --ssl). Never raw SSH on 443 — DPI detects SSH banner.
+32. **Tailscale** — Looks like HTTPS to Derp servers. But Tailscale destinations are publicly documented — check during baseline whether target network already has Tailscale traffic before using.
+33. **WireGuard** — Encrypted UDP on single port to self-hosted endpoint. Preferred when Tailscale would be a new destination.
+34. **Reverse SSH** — Must be SSH-over-WebSocket or SSH tunneled inside TLS (stunnel/ncat --ssl). Never raw SSH on 443 — DPI detects SSH banner (`content:"SSH-"; port 443`).
 35. **Cellular** — Completely out-of-band. Bypasses target network entirely.
 36. **DNS tunneling** — Low rate, randomized, multiple domains.
+37. **Data exfil** — Automated credential push, nightly intel sync. Timed to match baseline upload patterns via traffic_mimicry.