pwn 0.5.618 → 0.5.621

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6d2c26dca00a6c45a763df37f813f0d789098ed87f8b7c5296dca5a7a72d4281
-  data.tar.gz: fc40bc082f3d549efd2cef1fbb11807a53b416caf2a8190769818f681cc600dd
+  metadata.gz: '0708b22c22f49ec48a8263fe296b3dea6055d87259fe6bd6f63b484049432d6a'
+  data.tar.gz: 7b0dd573b0e169afd93e8ae228a40d02b4331fcf989a78df884cfdd5649fac8a
 SHA512:
-  metadata.gz: f0269c36ff988d1817214345cf77c347a8c1f22104ba822b6982aa4fe6318086e69793f42a5d563bb061ec543cf7a5bb99877649f7f1554c8d6a182ab281356a
-  data.tar.gz: 269676fd1f2dbd6f5f78c3e645d0d4675df08d681b7db21d49c7937fc121bd1b74dfbd4f82b1a049c9e6f4579ed7e2d697403f28c45312dffbc29b6557cbb16a
+  metadata.gz: 840dd2114e03a96ecc79fad15d9204f18d1ce5f444561fe230d0da5ca3e6a35f4d93a41c6c69cf3d87b37edf46e5bbd64ca0cbe4440b1a3ef9a268b5f918b39b
+  data.tar.gz: 0a18d690d4bc222a319500c7301c20f8a9629111e11498489ddf7516b6c2afe5ab6d6daf20354bea580688ad58bd7b85708f699cfe9c399dc8f1d23f65391bb1

data/Gemfile

@@ -50,7 +50,7 @@ gem 'libusb', '0.7.2'
 gem 'luhn', '3.0.0'
 gem 'mail', '2.9.1'
 gem 'mcp', '0.23.0'
-gem 'meshtastic', '0.0.167'
+gem 'meshtastic', '0.0.169'
 gem 'metasm', '1.0.6'
 gem 'mongo', '2.24.1'
 gem 'msfrpc-client', '1.1.2'
@@ -81,7 +81,7 @@ gem 'rmagick', '7.0.5'
 gem 'rqrcode', '3.2.0'
 gem 'rspec', '3.13.2'
 gem 'rtesseract', '3.1.4'
-gem 'rubocop', '1.88.1'
+gem 'rubocop', '1.88.2'
 gem 'rubocop-rake', '0.7.1'
 gem 'rubocop-rspec', '3.10.2'
 gem 'ruby-audio', '1.6.1'

data/README.md

@@ -51,19 +51,26 @@ Five layers, edges only ever go down:
 ![PWN Overall Architecture](documentation/diagrams/overall-pwn-architecture.svg)
 
 The AI layer closes a **self-improvement loop** on every turn — Metrics +
-Learning (introspection) joined with Snapshot + Drift + Intel (extrospection)
-via `extro_correlate`, so the agent knows whether a failure was *its* fault or
-*the world* changed:
+Learning + **Mistakes** (introspection / negative feedback) joined with
+Snapshot + Drift + Intel + RF + **Web** (extrospection) — plus browser-backed **`extro_verify`** self fact-checking — via `extro_correlate`, so the
+agent knows whether a failure was *its* fault or *the world* changed —
+**and does not repeat the same mistake twice**:
 
 ![pwn-ai Feedback Learning Loop](documentation/diagrams/pwn-ai-feedback-learning-loop.svg)
 
+Failures are fingerprinted cross-session (`~/.pwn/mistakes.json`), tagged
+`[REPEATING]` / `[REGRESSED]`, and their **fix** is handed straight back inline
+on the next recurrence:
+
+![Mistakes Negative-Feedback Loop](documentation/diagrams/mistakes-negative-feedback.svg)
+
 And **Swarm** runs multiple personas — each a full tool-calling agent,
 optionally on a *different* LLM engine — over a shared append-only bus:
 
 ![Swarm Multi-Agent](documentation/diagrams/swarm-multi-agent.svg)
 
 Full pages: [How PWN Works](documentation/How-PWN-Works.md) ·
-[All 26 Data-Flow Diagrams](documentation/Diagrams.md)
+[All 27 Data-Flow Diagrams](documentation/Diagrams.md)
 
 ---
 
@@ -76,8 +83,9 @@ The complete wiki lives in this repo at **[`documentation/Home.md`](documentatio
 | [What is PWN](documentation/What-is-PWN.md) | [`pwn` REPL](documentation/pwn-REPL.md) | [AI / LLM Integration](documentation/AI-Integration.md) | [Plugins (66)](documentation/Plugins.md) |
 | [Why PWN](documentation/Why-PWN.md) | [`pwn-ai` Agent](documentation/pwn-ai-Agent.md) | [Agent Tool Registry](documentation/Agent-Tool-Registry.md) | [SAST (48)](documentation/SAST.md) |
 | [How PWN Works](documentation/How-PWN-Works.md) | [CLI Drivers (52)](documentation/CLI-Drivers.md) | [Memory · Skills · Learning](documentation/Skills-Memory-Learning.md) | [AWS (90)](documentation/AWS.md) |
-| [Installation](documentation/Installation.md) | [Build a Driver](documentation/Drivers.md) | [Extrospection](documentation/Extrospection.md) | [WWW (21)](documentation/WWW.md) |
-| [General Usage](documentation/General-PWN-Usage.md) | | [Swarm (multi-agent)](documentation/Swarm.md) | [SDR / Radio](documentation/SDR.md) |
+| [Installation](documentation/Installation.md) | [Build a Driver](documentation/Drivers.md) | [Mistakes (neg-feedback)](documentation/Mistakes.md) | [WWW (21)](documentation/WWW.md) |
+| [General Usage](documentation/General-PWN-Usage.md) | | [Extrospection](documentation/Extrospection.md) | [SDR / Radio](documentation/SDR.md) |
+| [Configuration](documentation/Configuration.md) | | [Swarm (multi-agent)](documentation/Swarm.md) | [Hardware](documentation/Hardware.md) |
 | [Configuration](documentation/Configuration.md) | | [Sessions](documentation/Sessions.md) · [Cron](documentation/Cron.md) | [Reports](documentation/Reporting.md) |
 | [`~/.pwn/` Persistence](documentation/Persistence.md) | | | [BurpSuite](documentation/BurpSuite.md) · [NmapIt](documentation/NmapIt.md) |
 | **[All Diagrams](documentation/Diagrams.md)** | | | [Metasploit](documentation/Metasploit.md) · [Fuzzing](documentation/Fuzzing.md) |

data/bin/pwn_gqrx_scanner

@@ -76,7 +76,7 @@ PWN::Driver::Parser.new do |options|
     opts[:fft_scan] = f
   end
 
-  options.on('-SRATE', '--sample-rate=RATE', '<Optional --fft-scan - Visible span/sample_rate in Hz (default 1_000_000)>') do |s|
+  options.on('--sample-rate=RATE', '<Optional --fft-scan - Visible span/sample_rate in Hz (default 1_000_000). NOTE: no short flag; -S is --strength-lock>') do |s|
     opts[:sample_rate] = s
   end
 
@@ -84,11 +84,11 @@ PWN::Driver::Parser.new do |options|
     opts[:nfft] = n
   end
 
-  options.on('-AINT', '--avg=INT', '<Optional --fft-scan - FFT averages (default 2)>') do |a|
+  options.on('--avg=INT', '<Optional --fft-scan - FFT averages (default 8). NOTE: no short flag; -A is --audio-gain>') do |a|
     opts[:avg] = a
   end
 
-  options.on('-CSEC', '--capture-secs=SEC', '<Optional --fft-scan - Capture seconds per chunk (default 0.03)>') do |c|
+  options.on('-CSEC', '--capture-secs=SEC', '<Optional --fft-scan - Capture seconds per chunk (default 0.10)>') do |c|
     opts[:capture_secs] = c
   end
 
@@ -99,6 +99,14 @@ PWN::Driver::Parser.new do |options|
   options.on('-ODB', '--strength-offset-db=FLOAT', '<Optional - Power offset in dB (default 0.0)>') do |o|
     opts[:strength_offset_db] = o
   end
+
+  options.on('--min-snr-db=FLOAT', '<Optional --fft-scan - Minimum SNR (dB above per-chunk noise floor) to report a signal (default 12.0)>') do |m|
+    opts[:min_snr_db] = m
+  end
+
+  options.on('--min-bw-ratio=FLOAT', '<Optional --fft-scan - Reject FFT peaks narrower than RATIO * band-plan bandwidth as spurs (default 0.30)>') do |r|
+    opts[:min_bw_ratio] = r
+  end
 end.parse!
 
 begin
@@ -178,13 +186,17 @@ begin
   sample_rate = sample_rate.to_i
   nfft = opts[:nfft] || 2048
   nfft = nfft.to_i
-  avgv = opts[:avg] || 2
+  avgv = opts[:avg] || 8
   avgv = avgv.to_i
-  capture_secs = opts[:capture_secs] || 0.03
+  capture_secs = opts[:capture_secs] || 0.10
   capture_secs = capture_secs.to_f
   keep_spectrum = opts[:keep_spectrum] ? true : false
   strength_offset_db = opts[:strength_offset_db]
   strength_offset_db = strength_offset_db.to_f unless strength_offset_db.nil?
+  min_snr_db = opts[:min_snr_db]
+  min_snr_db = min_snr_db.to_f unless min_snr_db.nil?
+  min_bw_ratio = opts[:min_bw_ratio]
+  min_bw_ratio = min_bw_ratio.to_f unless min_bw_ratio.nil?
 
   if fft_scan
     puts '[*] --fft-scan requested: using fast FFT panoramic mode (#fast_scan_range)'
@@ -198,6 +210,14 @@ begin
       strength_lock: strength_lock,
       keep_spectrum: keep_spectrum,
       strength_offset_db: strength_offset_db,
+      min_snr_db: min_snr_db,
+      precision: precision,
+      min_bw_ratio: min_bw_ratio,
+      demodulator_mode: demodulator_mode,
+      bandwidth: bandwidth,
+      squelch: squelch,
+      decoder: decoder,
+      location: location,
       scan_log: scan_log
     )
     puts "FFT Scan complete: #{fast_resp[:total]} signals found."

data/documentation/Agent-Tool-Registry.md

@@ -6,7 +6,7 @@ toolsets; the JSON-Schema for each tool is what the model actually sees.
 
 ![Tool registry](diagrams/agent-tool-registry.svg)
 
-## Toolsets → Tools
+## Toolsets → Tools  (10 toolsets · 54 tools)
 
 | Toolset | Tools | Backed by |
 |---|---|---|
@@ -15,9 +15,9 @@ toolsets; the JSON-Schema for each tool is what the model actually sees.
 | `memory` | `memory_remember` · `memory_recall` · `memory_forget` · `memory_clear` | `PWN::Memory` → `~/.pwn/memory.json` |
 | `skills` | `skill_list` · `skill_view` · `skill_create` · `skill_add_reference` · `skill_delete` | `~/.pwn/skills/*.md` |
 | `sessions` | `sessions_list` · `sessions_view` · `sessions_current` · `sessions_delete` · `sessions_stats` | `PWN::Sessions` → `~/.pwn/sessions/` |
-| `learning` | `learning_note_outcome` · `learning_reflect` · `learning_distill_skill` · `learning_stats` · `learning_outcomes` · `learning_consolidate` · `learning_reset` · `learning_auto_reflect_toggle` | `PWN::AI::Agent::Learning` → `~/.pwn/learning.jsonl` |
+| `learning` | `learning_note_outcome` · `learning_reflect` · `learning_distill_skill` · `learning_stats` · `learning_outcomes` · `learning_consolidate` · `learning_reset` · `learning_auto_reflect_toggle` · **`mistakes_list`** · **`mistakes_record`** · **`mistakes_resolve`** · **`mistakes_reset`** | `PWN::AI::Agent::Learning` + `PWN::AI::Agent::Mistakes` → `~/.pwn/learning.jsonl` + `~/.pwn/mistakes.json` |
 | `metrics` | `metrics_summary` · `metrics_reset` | `PWN::AI::Agent::Metrics` → `~/.pwn/metrics.json` |
-| `extrospection` | `extro_snapshot` · `extro_drift` · `extro_observe` · `extro_observations` · `extro_intel` · `extro_correlate` · `extro_stats` · `extro_reset` · `extro_auto_toggle` | `PWN::AI::Agent::Extrospection` → `~/.pwn/extrospection.json` |
+| `extrospection` | `extro_snapshot` · `extro_drift` · `extro_observe` · `extro_observations` · `extro_intel` · **`extro_watch`** · **`extro_verify`** · `extro_correlate` · `extro_stats` · `extro_reset` · `extro_auto_toggle` | `PWN::AI::Agent::Extrospection` (+ `PWN::Plugins::TransparentBrowser`) → `~/.pwn/extrospection.json` |
 | `cron` | `cron_list` · `cron_create` · `cron_run` · `cron_enable` · `cron_disable` · `cron_remove` | `PWN::Cron` → `~/.pwn/cron/jobs.yml` |
 | `swarm` | `agent_list` · `agent_spawn` · `agent_ask` · `agent_debate` · `agent_broadcast` · `swarm_bus` · `swarm_list` | `PWN::AI::Agent::Swarm` → `~/.pwn/agents.yml` + `~/.pwn/swarm/` |
 
@@ -51,6 +51,6 @@ recon:
   engine: ollama
 ```
 
-**See also:** [pwn-ai Agent](pwn-ai-Agent.md) · [Swarm](Swarm.md)
+**See also:** [pwn-ai Agent](pwn-ai-Agent.md) · [Mistakes](Mistakes.md) · [Swarm](Swarm.md)
 
 [← Home](Home.md)

data/documentation/Cron.md

@@ -41,6 +41,19 @@ At 02:00 the system cron fires `PWN::Cron.run`, which spins up a headless
 also updates Learning/Metrics/Extrospection — so tomorrow's interactive
 session already knows what changed overnight.
 
+```ruby
+cron_create(
+  name: 'memory_revalidate',
+  schedule: '0 4 * * 0',
+  ruby: 'PWN::AI::Agent::Extrospection.revalidate_memory'
+)
+```
+
+Weekly, headless-browser fact-check of every `PWN::Memory` `:fact` containing
+a CVE / version string / URL. Refuted entries get prefixed `[UNVERIFIED
+yyyy-mm-dd]` so the injected MEMORY block stops calcifying into
+confidently-wrong priors — see [Extrospection § revalidate_memory](Extrospection.md).
+
 **See also:** [Sessions](Sessions.md) · [Extrospection](Extrospection.md) ·
 [CLI Drivers](CLI-Drivers.md)
 

data/documentation/Diagrams.md

@@ -1,6 +1,6 @@
 # PWN Data-Flow Diagrams
 
-26 SVG diagrams, all rendered from Graphviz sources in
+27 SVG diagrams, all rendered from Graphviz sources in
 [`diagrams/dot/`](diagrams/dot/) with a single shared visual theme
 (see [`_THEME.md`](diagrams/dot/_THEME.md)). Rebuild everything with:
 
@@ -51,11 +51,15 @@ groups) so lines never criss-cross.
 [source](diagrams/dot/pwn-ai-feedback-learning-loop.dot) · doc: [Skills, Memory & Learning](Skills-Memory-Learning.md)
 ![pwn-ai-feedback-learning-loop](diagrams/pwn-ai-feedback-learning-loop.svg)
 
+### Mistakes — Negative-Feedback Loop
+[source](diagrams/dot/mistakes-negative-feedback.dot) · doc: [Mistakes](Mistakes.md)
+![mistakes-negative-feedback](diagrams/mistakes-negative-feedback.svg)
+
 ### Multi-Provider LLM Integration
 [source](diagrams/dot/ai-integration-tool-calling.dot) · doc: [AI Integration](AI-Integration.md)
 ![ai-integration-tool-calling](diagrams/ai-integration-tool-calling.svg)
 
-### Agent Tool Registry (10 toolsets)
+### Agent Tool Registry (10 toolsets · 54 tools)
 [source](diagrams/dot/agent-tool-registry.dot) · doc: [Agent Tool Registry](Agent-Tool-Registry.md)
 ![agent-tool-registry](diagrams/agent-tool-registry.svg)
 

data/documentation/Extrospection.md

@@ -1,23 +1,47 @@
 # Extrospection — World Awareness
 
 `PWN::AI::Agent::Extrospection` is the **outward-facing** counterpart to
-[Learning](Skills-Memory-Learning.md). Where Learning/Metrics ask *"how well
-did **I** do?"*, Extrospection asks *"what does the **world** look like right
-now, and has it changed under me?"*
+[Learning](Skills-Memory-Learning.md). Where Learning/Metrics/Mistakes ask
+*"how well did **I** do?"*, Extrospection asks *"what does the **world** look
+like right now, and has it changed under me?"*
 
 ![Extrospection engine](diagrams/extrospection-world-awareness.svg)
 
+## Snapshot sections  (`extro_snapshot(sections: […])`)
+
+| Section | Probe | Captures |
+|---|---|---|
+| `:host` | `probe_host` | hostname · uname · distro · arch · CPU · mem |
+| `:net` | `probe_net` | interfaces · listening ports · default route |
+| `:toolchain` | `probe_toolchain` | `PROBE_BINS` — nmap curl git ruby python3 gcc msfconsole sqlmap burpsuite zaproxy openssl docker **+ RF_BINS** |
+| `:repo` | `probe_repo` | HEAD · branch · dirty · origin |
+| `:env` | `probe_env` | ruby / gem / bundler / PWN version |
+| **`:rf`** | **`probe_rf`** | **RTL-SDR / HackRF presence · SoapySDR devices · GQRX socket (127.0.0.1:7356) · Flipper serial · `/dev/tty{USB,ACM}*` · band-plan count** |
+| **`:web`** *(opt-in)* | **`probe_web`** | **Renders `web_anchors` via `PWN::Plugins::TransparentBrowser` (`:headless`) — HTTP status · final URL · `<title>` · meta[generator] · `Server` · SHA-256 of *rendered* DOM text · TLS cert fp / notAfter · optional screenshot → `~/.pwn/extrospection/web/<host>.png`** |
+
+`RF_BINS = %w[rtl_sdr rtl_test rtl_433 hackrf_info gqrx dump1090 multimon-ng SoapySDRUtil]`
+— these are also merged into `PROBE_BINS` so RF-toolchain drift shows up under
+`toolchain.*` diff keys.
+
+`DEFAULT_WEB_ANCHORS` = NVD CVE 2.0 API, Exploit-DB, upstream `pwn/version.rb`.
+Override / extend via `PWN::Env[:ai][:agent][:extrospection][:web][:anchors]`; set
+`allow_targets: true` to also fingerprint `PWN::Env[:targets]`. **`:web` is never
+run by `auto_extrospect`** — a headless browser is ~1–3 s cold vs ~50 ms for
+`probe_host`, so it's opt-in (`extro_snapshot(sections: %i[web])`).
+
 ## Verbs
 
 | Tool | Does | Persists to |
 |---|---|---|
-| `extro_snapshot` | Fingerprint host/net/toolchain/repo/env → hash | `extrospection.json` (`snapshot` + rotates `previous`) |
+| `extro_snapshot` | Fingerprint host/net/toolchain/repo/env/**rf**/*web* → hash | `extrospection.json` (`snapshot` + rotates `previous`) |
 | `extro_drift` | Diff live-vs-stored (or stored-vs-previous) | — returns `{changed, added, removed}` with dotted keys |
-| `extro_observe` | Record a recon fact (banner, CVE match, topology note) | `observations[]` |
+| `extro_observe` | Record a fact — `category:` one of `recon vuln intel target network env` **`rf` `web`** `misc` | `observations[]` |
 | `extro_observations` | Query recorded facts by source/category/target/tag | — |
 | `extro_intel` | Query NVD / CIRCL / Exploit-DB for keyword or CVE | optional `record: true` → `:intel` observations |
+| **`extro_watch`** | **Render a URL headless, hash the *rendered* DOM, screenshot, diff vs prior** | `observations[]` (`category: :web`) |
+| **`extro_verify`** | **Browser-backed self fact-check of a claim (`:cve` `:version` `:doc` `:generic`) → `:confirmed`/`:refuted`/`:unknown`** | `Mistakes.record` / `observe(:intel)` / `Learning.note_outcome` |
 | `extro_correlate` | **Join** introspection ↔ extrospection | — actionable findings |
-| `extro_stats` | snapshot age · observation count · drift counts | — |
+| `extro_stats` | snapshot age · observation count · drift counts · **rf_devices** · **web_anchors** | — |
 | `extro_reset` | Wipe snapshot + observations (new engagement) | — |
 | `extro_auto_toggle` | Enable/disable auto-snapshot after every final answer | `PWN::Env[:ai][:agent][:auto_extrospect]` |
 
@@ -27,28 +51,89 @@ now, and has it changed under me?"*
 (a) Metrics tools with <50 % success   ×  toolchain drift / missing binaries
 (b) Learning failures on day X         ×  host/net/repo drift on day X
 (c) recorded :intel observations       ×  installed component versions
+(d) recorded :rf observations          ×  missing SDR hardware / RF_BINS
+(e) recorded :web DOM drift on target  ×  Learning failures citing that host
+(f) extro_verify :refuted claims       ×  stale PWN::Memory :fact entries
+(g) :intel obs whose feed anchor is    ×  probe_web-unreachable → downgrade weight
 ```
 
 Output tells the agent whether a failure was **its own fault** ("I called the
-API wrong") or **the world changed** ("nmap was upgraded and the flag moved")
-— and that distinction is written back into MEMORY so the next run doesn't
-waste iterations rediscovering it.
+API wrong" → belongs in [Mistakes](Mistakes.md)) or **the world changed**
+("nmap was upgraded and the flag moved", "the HackRF was unplugged") — and
+that distinction is written back into MEMORY so the next run doesn't waste
+iterations rediscovering it.
+
+## `extro_verify` — proactive fact-checking (the browser as a sense organ)
+
+`probe_rf` gave Extrospection **ears**; `PWN::Plugins::TransparentBrowser` gives
+it **eyes**. `extro_verify(claim:)` renders a canonical source *with JavaScript
+executed* and returns a verdict:
+
+| `kind:` | Canonical source (rendered headless) | Verdict logic |
+|---|---|---|
+| `:cve` | `nvd.nist.gov/vuln/detail/<id>` + `cve.org/CVERecord?id=` | CVE exists? affected-product string overlaps claimed product/version? |
+| `:version` | rubygems.org / PyPI / GitHub search | claimed "latest is X" vs scraped latest |
+| `:doc` | the URL the model cited | 200? title/body contains ≥ 40 % of the quoted-snippet tokens (fuzzy)? |
+| `:generic` | DuckDuckGo HTML (proxy-able, no API key) | ≥ 50 % token overlap in top result snippets |
+
+```text
+                  ┌── :refuted  → Mistakes.record(tool:'assumption', …)  → KNOWN MISTAKES block ∀ future runs
+extro_verify ─────┼── :confirmed→ observe(category::intel, ttl:30d)      → EXTROSPECTION block, freshness-bound
+                  └── :unknown  → Learning.note_outcome(tags:[needs_human])
+```
+
+This adds a **proactive** trigger to the negative-feedback loop: today
+`Mistakes.record` fires only *reactively* (a tool blew up, or a human said
+"that's wrong"). `extro_verify` lets the agent catch itself being wrong about
+the world **before** a human does. `commit: false` returns the verdict without
+side-effects.
+
+### `revalidate_memory` — the browser as GC for `PWN::Memory`
+
+`learning_consolidate` only dedupes/truncates; it never asks *"is this still
+true?"*. `PWN::AI::Agent::Extrospection.revalidate_memory` walks every
+`PWN::Memory` `:fact` containing a CVE / version string / URL, runs `verify()`
+on it, and prefixes stale ones with `[UNVERIFIED yyyy-mm-dd]` so the injected
+MEMORY block stops calcifying into confidently-wrong priors. Schedule it:
+
+```ruby
+cron_create(name: 'memory_revalidate', schedule: '0 4 * * 0',
+            ruby: 'PWN::AI::Agent::Extrospection.revalidate_memory')
+```
+
+### Configuration
+
+```ruby
+PWN::Env[:ai][:agent][:extrospection][:web] = {
+  anchors:          ['https://target.acme/api/version', …],  # else DEFAULT_WEB_ANCHORS
+  proxy:            'tor',      # or 'http://127.0.0.1:8080' (Burp) — honoured by verify/watch/probe_web
+  max_anchors:      8,
+  per_page_timeout: 15,
+  screenshot:       false,      # → ~/.pwn/extrospection/web/<host>.png
+  allow_targets:    false       # OPSEC: also fingerprint PWN::Env[:targets] (active recon!)
+}
+```
+
 
 ## Typical engagement flow
 
 ```ruby
 extro_reset(confirm: true)             # clean slate for new scope
-extro_snapshot                         # baseline
+extro_snapshot                         # baseline (six local sections; add sections:%i[web] for anchors)
 # … recon …
 extro_observe(source: 'nmap', target: '10.0.0.5',
               category: 'recon', data: 'OpenSSH 8.2p1 Ubuntu')
+extro_observe(source: 'gqrx', target: '433.920MHz',
+              category: 'rf', data: 'peak -34.2 dBFS bw=200k FSK — likely garage remote')
 extro_intel(query: 'OpenSSH 8.2p1', record: true)
+extro_watch(url: 'https://target.acme/api/version')       # DOM-hash + screenshot; changed:true on next run
+extro_verify(claim: 'CVE-2026-12345 affects OpenSSL 3.2.1')  # → Mistakes/Memory/observe on verdict
 # … days later, something breaks …
 extro_drift                            # what moved?
 extro_correlate                        # why did it break?
 ```
 
 **See also:** [Skills, Memory & Learning](Skills-Memory-Learning.md) ·
-[pwn-ai Agent](pwn-ai-Agent.md)
+[Mistakes](Mistakes.md) · [SDR](SDR.md) · [Transparent Browser](Transparent-Browser.md) · [Cron](Cron.md) · [pwn-ai Agent](pwn-ai-Agent.md)
 
 [← Home](Home.md)

data/documentation/Home.md

@@ -20,7 +20,7 @@
 | [Installation](Installation.md) | RVM, gem, `./install.sh`, first launch |
 | [General Usage](General-PWN-Usage.md) | Day-one cheat sheet |
 | [Configuration](Configuration.md) | `~/.pwn/config.yml` — engines, keys, agent options |
-| **[All Data-Flow Diagrams](Diagrams.md)** | **26 SVGs** in one scrollable page |
+| **[All Data-Flow Diagrams](Diagrams.md)** | **27 SVGs** in one scrollable page |
 
 ## 🚪 Entry Points
 
@@ -36,9 +36,10 @@
 | | |
 |---|---|
 | [AI / LLM Integration](AI-Integration.md) | OpenAI · Anthropic · Grok (OAuth) · Gemini · Ollama |
-| [Agent Tool Registry](Agent-Tool-Registry.md) | 10 toolsets · 45+ LLM-callable tools |
+| [Agent Tool Registry](Agent-Tool-Registry.md) | 10 toolsets · 54 LLM-callable tools |
 | [Memory · Skills · Learning](Skills-Memory-Learning.md) | Introspection — the self-improvement loop |
-| [Extrospection](Extrospection.md) | World-awareness — snapshot · drift · intel · correlate |
+| [Mistakes](Mistakes.md) | **Negative feedback** — fingerprint failures · do-NOT-repeat · `[REPEATING]`/`[REGRESSED]` · inline self-correction |
+| [Extrospection](Extrospection.md) | World-awareness — snapshot · drift · intel · **watch** · **verify** · correlate · **rf** · **web** |
 | [Swarm (Multi-Agent)](Swarm.md) | Personas · ask · debate · broadcast · shared bus |
 | [Sessions](Sessions.md) | Transcript persistence + reflection |
 | [Cron](Cron.md) | Scheduled autonomous jobs |
@@ -57,7 +58,7 @@
 | [SAST (48 rules)](SAST.md) | Static analysis + test-case engine |
 | [WWW (21 drivers)](WWW.md) | Browser automations for real sites |
 | [AWS (90 services)](AWS.md) | Cloud-security enumeration |
-| [SDR](SDR.md) | GQRX · FlipperZero · RFIDler · SonMicro |
+| [SDR](SDR.md) | GQRX · FlipperZero · RFIDler · SonMicro · **Decoder::* (20 protocols)** |
 | [Blockchain](Blockchain.md) | BTC · ETH helpers |
 | [Bounty](Bounty.md) | Lifecycle / auth-replay tooling |
 | [Reports](Reporting.md) | HTML/JSON output + DefectDojo/Jira |

data/documentation/How-PWN-Works.md

@@ -27,11 +27,12 @@ hardware).
 | Module | Role |
 |---|---|
 | `Loop` | plan → dispatch tool_calls → observe → repeat until final answer |
-| `Registry` | JSON-Schema function definitions grouped into 10 **toolsets** |
+| `Registry` | JSON-Schema function definitions grouped into 10 **toolsets** · 54 tools |
 | `Dispatch` / `Result` | execute a tool, capture stdout/value/error/duration |
-| `PromptBuilder` | inject MEMORY / SKILLS / LEARNING / EXTROSPECTION blocks |
+| `PromptBuilder` | inject MEMORY / SKILLS / LEARNING / **KNOWN MISTAKES + FIXES** / METRICS / EXTROSPECTION blocks |
 | `Metrics` · `Learning` | **introspection** — how well am I doing? |
-| `Extrospection` | **extrospection** — what does the world look like? |
+| `Mistakes` | **negative feedback** — fingerprint failures, do NOT repeat, `[REPEATING]`/`[REGRESSED]`, inline `correction_hint` |
+| `Extrospection` | **extrospection** — what does the world look like? (host · net · toolchain · repo · env · **rf**) |
 | `Swarm` | multi-agent personas over a shared JSONL bus |
 
 See [Agent Tool Registry](Agent-Tool-Registry.md) for every tool the LLM can call.
@@ -53,7 +54,9 @@ See [Persistence](Persistence.md) for the byte-level layout of each file.
 
 ## The feedback loop
 
-The reason L2 exists is to close this loop on every turn:
+The reason L2 exists is to close this loop on every turn — successes
+become skills/lessons, **failures become fingerprinted mistakes with fixes**,
+and both are re-injected into the very next system prompt:
 
 ![Self-improvement loop](diagrams/pwn-ai-feedback-learning-loop.svg)
 

data/documentation/Mistakes.md

@@ -0,0 +1,97 @@
+# Mistakes — The Negative-Feedback Loop
+
+`PWN::AI::Agent::Mistakes` is the **negative** half of the pwn-ai learning
+loop. Where [Learning](Skills-Memory-Learning.md) records *what worked* and
+[Metrics](Skills-Memory-Learning.md) records *how often* a tool worked,
+Mistakes records **specific failure patterns** with a stable fingerprint so
+the agent can (a) recognise it is repeating itself, (b) be told exactly what
+**not** to do again in every future system prompt, and (c) capture the **fix**
+once one is found so the avoidance lesson becomes an actionable correction.
+
+![Mistakes negative-feedback loop](diagrams/mistakes-negative-feedback.svg)
+
+## The failure fingerprint
+
+A "mistake" is keyed by `sha12(tool + normalised_error)`. Normalisation strips
+volatile bits — paths, hex addresses, `:LINE`, `port N`, timestamps, UUIDs,
+PIDs — so `NoMethodError … at foo.rb:42` and `… at foo.rb:99` collapse to
+**one** signature and its `:count` climbs. **That count *is* the repeat
+detector**, and it survives across sessions.
+
+| Field | Meaning |
+|---|---|
+| `signature` | 12-hex-char sha of `(tool, normalised_error)` — stable across runs |
+| `tool` | component the failure was in (`shell`, `pwn_eval`, `assumption`, `assistant_answer`, a module name…) |
+| `error` | normalised error text (paths/lines/addrs/ts stripped) |
+| `count` | **cross-session** recurrence count — drives `[REPEATING]` at ≥ 3 |
+| `resolved` / `fix` | set by `mistakes_resolve` — promoted to a `PWN::Memory` `:lesson` |
+| `regressed` | auto-set when a *resolved* signature recurs — reopened as `[REGRESSED]` |
+| `sessions` | last 10 session_ids that hit it |
+
+## How the loop closes (why it does **not** repeat mistakes)
+
+```text
+Loop.run --(tool failure)---------> Mistakes.record         (persist + count++)
+Loop.run --(same sig, count≥3)----> guard_repeated_failure  (uses PERSISTENT count →
+                                                             fires on the 1st recurrence
+                                                             in a NEW session, not the 3rd)
+Loop.run --(failure w/ known fix)-> inline correction_hint  ("seen 5×, sig=…, KNOWN FIX: …"
+                                                             → self-corrects NEXT iteration)
+Loop.run --(user says "wrong")----> check_user_correction   (flip last outcome + record)
+PromptBuilder <-------------------- Mistakes.to_context     (KNOWN MISTAKES + KNOWN FIXES)
+model --(tool call)---------------> mistakes_record / mistakes_resolve
+```
+
+## Five ingest paths — nothing slips through
+
+| Source | Trigger | What is recorded |
+|---|---|---|
+| `:tool` | any tool dispatch returns `success:false` / raises | *automatic* — `Loop.record_metrics` |
+| `:loop` | iteration budget exhausted with no final answer | *automatic* — `Loop.run` epilogue |
+| `:user_correction` | next user message matches `CORRECTION_RX` (*"no that's wrong"*, *"still broken"*, *"try again"*, …) | `check_user_correction` — also flips the previous `Learning` outcome to `success:false` |
+| `:model` | the model itself calls `mistakes_record` | wrong assumption, wrong file, hallucinated API — failures that are **not** dispatch errors |
+| **`:model` (proactive)** | **`extro_verify(claim:)` returns `:refuted`** | **`Mistakes.record(tool:'assumption', error:'REFUTED …: <claim>')` — the browser caught the model being wrong about the world *before* a human did** |
+
+## Tools
+
+| Tool | Does |
+|---|---|
+| `mistakes_list` | count-sorted fingerprints (signature · tool · error · count · resolved · fix) |
+| `mistakes_record` | proactively fingerprint a semantic mistake YOU just made |
+| `mistakes_resolve` | attach the **fix** → promoted to `PWN::Memory` `:lesson` **and** handed straight back inline via `correction_hint` on the next recurrence. If the same sig recurs it auto-reopens as `[REGRESSED]`. |
+| `mistakes_reset` | wipe `~/.pwn/mistakes.json` (new engagement) |
+
+## What the model sees every turn
+
+`PromptBuilder` injects `Mistakes.to_context` between the `LEARNING` and
+`TOOL EFFECTIVENESS` blocks:
+
+```text
+KNOWN MISTAKES (do NOT repeat — call mistakes_resolve once fixed)
+  ✗ [a1b2c3d4e5f6] shell ×4 [REPEATING]: nmpa: command not found
+  ✗ [7f8e9d0c1b2a] pwn_eval ×2 [REGRESSED]: nomethoderror: undefined method `scan_range' — last fix (insufficient): use fast_scan_range
+KNOWN FIXES (apply these instead of repeating the mistake)
+  ✓ [c0ffee123456] shell: connection refused port N — FIX: start ZAP first via PWN::Plugins::Zaproxy.start
+```
+
+…and every failed dispatch gets an **inline** postscript:
+
+```text
+[pwn-ai/mistakes] seen 4× across 3 session(s), sig=a1b2c3d4e5f6 | KNOWN FIX: binary is spelled `nmap`
+```
+
+so the very next iteration self-corrects without re-discovering the fix.
+
+## Regression detection
+
+Resolving a mistake does **not** delete it. If the same signature fires again
+after `mistakes_resolve`, `record()` clears `:resolved`, sets `:regressed`,
+and the entry re-enters the `KNOWN MISTAKES` block tagged `[REGRESSED]` with
+its (now-insufficient) previous fix shown inline — the strongest possible
+"your last fix didn't hold" signal.
+
+**See also:** [Skills, Memory & Learning](Skills-Memory-Learning.md) ·
+[Extrospection](Extrospection.md) · [Persistence](Persistence.md) ·
+[pwn-ai Agent](pwn-ai-Agent.md)
+
+[← Home](Home.md)

data/documentation/Persistence.md

@@ -10,8 +10,10 @@ Every byte PWN remembers between processes lives here.
 | `memory.json` | `PWN::Memory` | JSON array | `memory_clear` | facts · prefs · lessons · env — injected into every prompt |
 | `skills/*.md` | `PWN::Config.load_skills` | Markdown + YAML front-matter | `skill_delete` | reusable procedures + `references:` (CWE/CVE/ATT&CK/NIST) |
 | `learning.jsonl` | `PWN::AI::Agent::Learning` | JSON-per-line | `learning_reset` | task outcome log → success_rate |
+| **`mistakes.json`** | **`PWN::AI::Agent::Mistakes`** | **JSON `{sig → entry}`** | **`mistakes_reset`** | **failure fingerprints · cross-session count · fix · `[REPEATING]` · `[REGRESSED]`** |
 | `metrics.json` | `PWN::AI::Agent::Metrics` | JSON | `metrics_reset` | per-tool calls · success · avg_duration · last_error |
-| `extrospection.json` | `PWN::AI::Agent::Extrospection` | JSON | `extro_reset` | host snapshot + previous baseline + observations[] |
+| `extrospection.json` | `PWN::AI::Agent::Extrospection` | JSON | `extro_reset` | host/net/toolchain/repo/env/**rf**/**web** snapshot + previous baseline + observations[] |
+| `extrospection/web/*.png` | `PWN::AI::Agent::Extrospection` | PNG | `rm -rf` | headless-browser screenshots from `probe_web` / `extro_watch` (opt-in) |
 | `sessions/*.jsonl` | `PWN::Sessions` | JSON-per-line | `sessions_delete` | full transcript per pwn-ai run |
 | `cron/jobs.yml` | `PWN::Cron` | YAML | `cron_remove` | scheduled prompt/ruby/script jobs |
 | `cron/log/*.log` | `PWN::Cron` | text | rm | last_run output |
@@ -31,6 +33,7 @@ tar czf pwn-state-$(date +%F).tgz -C "$HOME" .pwn
 ```ruby
 # inside pwn-ai — keeps config & skills, wipes engagement-specific state
 extro_reset(confirm: true)     # host snapshot + observations
+mistakes_reset(confirm: true)  # failure fingerprints (host-specific errors)
 learning_reset(confirm: true)  # task outcomes (optional)
 metrics_reset(confirm: true)   # tool telemetry (optional)
 ```

data/documentation/SDR.md

@@ -6,18 +6,23 @@
 
 | Module | Purpose |
 |---|---|
-| **`GQRX`** | Remote-control a running GQRX instance over TCP: tune, set demod, squelch, record, `get_spectrum_snapshot` (pure-Ruby FFT), scan ranges |
+| **`GQRX`** | Remote-control a running GQRX instance over TCP: tune, set demod, squelch, record, `get_spectrum_snapshot` (pure-Ruby FFT — median noise floor, DC/LO-leakage null, band-edge guard), `fast_scan_range` |
 | `FlipperZero` | Serial control of Flipper (sub-GHz, NFC, IR, iButton) |
 | `RFIDler` | 125 kHz RFID reader/emulator |
 | `SonMicroRFID` | SM130 13.56 MHz reader |
 | `FrequencyAllocation` | ITU/FCC band-plan lookup — "what lives at 433.92 MHz?" |
-| `Decoder::*` | Demodulator/protocol helpers |
+| **`Decoder::*`** | 20 protocol demodulators/decoders — `ADSB APT Bluetooth DECT FLEX GPS GSM Iridium LoRa LTE Morse P25 Pager POCSAG RDS RFID RTL433 RTTY WiFi ZigBee` |
 
 ## CLI
 
 ```bash
-pwn_gqrx_scanner --start 430e6 --stop 440e6 --step 12.5e3 --mode fast
-pwn_gqrx_scanner --start 118e6 --stop 137e6 --mode iterative --squelch -60
+# FFT sweep — SNR-gated peak detection (no false-positive flood)
+pwn_gqrx_scanner --start 430e6 --stop 440e6 --fft-scan \
+                 --avg 8 --min-snr-db 10 --capture-secs 0.10
+
+# Classic iterative S-meter scan
+pwn_gqrx_scanner --start 118e6 --stop 137e6 --step 12.5e3 \
+                 --strength-lock -60 --audio-gain-db 6
 ```
 
 See skill `pwn_gqrx_scanner_fast_vs_iterative_scanning` for the trade-off.
@@ -33,7 +38,20 @@ PWN::SDR::FrequencyAllocation.lookup(freq: 433_920_000)
 # => { band: 'ISM 433', typical: ['garage doors', 'weather stations', …] }
 ```
 
-Record signal intel with `extro_observe(source: 'gqrx', category: 'recon', …)`.
+## RF ↔ Extrospection
+
+The AI agent is RF-aware. `extro_snapshot(sections: [:rf])` runs `probe_rf`
+(RTL-SDR / HackRF / SoapySDR / Flipper / GQRX-socket inventory) and RF signal
+intel is recorded with a first-class `:rf` observation category:
+
+```ruby
+extro_observe(source: 'gqrx', category: :rf, target: '433.920MHz',
+              data: 'peak -34.2 dBFS bw=200k FSK — likely garage remote')
+```
+
+`extro_correlate` then cross-references `:rf` observations against missing
+`RF_BINS` / unplugged hardware so the agent can tell "no signal" from "no
+dongle".
 
 **See also:** [Hardware](Hardware.md) · [Extrospection](Extrospection.md)