AUSPEX: a doctrine-tagged corpus of state-sponsored cyber operations

A hand-curated, source-anchored corpus of state-sponsored cyber events tagged against the strategic doctrines under which they were tasked — vendor attribution names the *who*, doctrine names the *why*, and the join is the contribution. 785 events across 15 doctrine-authoring states (US, RU, CN, IR, KP, IL, IN, PK, TR, BY, VN, UK, FR, KR, AE), with actor attributions (attributing-organization + confidence), doctrine links (evidentiary confidence + attacker/victim/defender perspective), victims, and per-claim sources with archived-snapshot content hashes. 222 actors, 86 doctrines (199 pillars), 179 policy-actions, 1,772 source records. Every event has been audited 6-point against its raw cited sources under a documented protocol (machine-performed, verified_by claude-opus-4.8; qc coverage 100% — 691 full / 94 partial) — a 100%-coverage record-vs-source audit, disclosed as distinct from independent human inter-rater verification. Ships with a formal JSON Schema, an independent verification harness (make verify), leakage-aware retrodictive + temporal-holdout attribution/doctrine engines, and a published reliability and verification methodology. Derived-fact provenance and layered licensing are documented in DATA-RIGHTS.md; the copyrighted source bodies themselves are NOT redistributed (only their URLs and SHA-256 content hashes are published). This is a frozen research snapshot; a continuously-maintained version is at https://auspex.blackflagintel.com.