pwn 0.5.628 → 0.5.631

data/documentation/Extrospection.md

@@ -1,4 +1,4 @@
-# Extrospection — World Awareness (on-demand sensing)
+# Extrospection - World Awareness (on-demand sensing)
 
 `PWN::AI::Agent::Extrospection` is the **outward-facing** counterpart to
 [Learning](Skills-Memory-Learning.md). Where Learning/Metrics/Mistakes ask
@@ -7,7 +7,7 @@ say when I need it for a better answer?"*
 
 **Primary intent = sense tools on demand**, not ambient inventory of the local host.
 
-| You need… | Call… |
+| You need... | Call... |
 |---|---|
 | Weather / public page content | `extro_watch` / `extro_verify` / TransparentBrowser |
 | Song on 101.1 FM (RDS) | **`extro_rf_tune(freq: "101.1")`** → RDS `now_playing` / `station` |
@@ -20,14 +20,14 @@ say when I need it for a better answer?"*
 | OCR image / barcode-QR | **`extro_vision`** |
 | Text-to-speech / speech-to-text | **`extro_voice`** |
 
-**Secondary** — cheap ambient baseline (`snapshot` / `drift` / `correlate`) so the
+**Secondary** - cheap ambient baseline (`snapshot` / `drift` / `correlate`) so the
 agent can distinguish "I called the API wrong" from "the world moved"
 (kernel upgrade, dongle unplugged). That baseline must never launch GUI / JVM /
 heavy REPL binaries.
 
 ![Extrospection engine](diagrams/extrospection-world-awareness.svg)
 
-## Snapshot sections  (`extro_snapshot(sections: […])`)
+## Snapshot sections  (`extro_snapshot(sections: [...])`)
 
 | Section | Probe | Captures | Auto? |
 |---|---|---|---|
@@ -38,7 +38,7 @@ heavy REPL binaries.
 | `:env` | `probe_env` | ruby / gem / bundler / PWN version / AI engine | ✅ `AUTO_SECTIONS` |
 | **`:rf`** | **`probe_rf`** | **RTL-SDR / HackRF presence · SoapySDR · GQRX sock · Flipper · serial · band-plans** | ❌ on-demand |
 | **`:web`** | **`probe_web`** | **Headless render of `web_anchors` (status / title / DOM sha / TLS / screenshot)** | ❌ on-demand |
-| **`:osint`** | **`probe_osint`** | **Public OSINT feed catalogue · keyed flags (Shodan/Hunter) · whois/dig bins** | ❌ on-demand |
+| **`:osint`** | **`probe_osint`** | **Public OSINT feed catalog · keyed flags (Shodan/Hunter) · whois/dig bins** | ❌ on-demand |
 | **`:serial`** | **`probe_serial`** | **`/dev/ttyUSB*` `/dev/ttyACM*` · by-id · minicom/picocom presence** | ❌ on-demand |
 | **`:telecomm`** | **`probe_telecomm`** | **BareSIP HTTP · SIP ports · baresip/asterisk/linphone bins** | ❌ on-demand |
 | **`:packet`** | **`probe_packet`** | **tshark/tcpdump/tcpreplay · ifaces · cap dir** | ❌ on-demand |
@@ -49,7 +49,7 @@ heavy REPL binaries.
 
 ```ruby
 SAFE_VERSION_BINS  = %w[nmap curl git ruby python3 gcc openssl docker]   # --version OK
-PRESENCE_ONLY_BINS = %w[burpsuite zaproxy msfconsole gqrx sqlmap]        # path only — NEVER spawn
+PRESENCE_ONLY_BINS = %w[burpsuite zaproxy msfconsole gqrx sqlmap]        # path only - NEVER spawn
 RF_BINS            = %w[rtl_sdr rtl_test rtl_433 hackrf_info gqrx dump1090 multimon-ng SoapySDRUtil]
 OSINT_BINS         = %w[whois dig host curl jq]
 SERIAL_BINS        = %w[minicom picocom screen cu]
@@ -60,7 +60,7 @@ VOICE_BINS         = %w[sox espeak-ng espeak festival whisper spd-say arecord ap
 AUTO_SECTIONS      = %i[host repo env]   # what auto_extrospect actually runs
 ```
 
-`burpsuite` is a Java launcher (`run_java -jar …/burpsuite.jar`). Running it for
+`burpsuite` is a Java launcher (`run_java -jar .../burpsuite.jar`). Running it for
 `--version` opens the real GUI → splash screen after every pwn-ai turn when
 `auto_extrospect` was wiring `probe_toolchain` into the default section set.
 **That was the bug.** Presence-only bins + `AUTO_SECTIONS` remove it.
@@ -74,9 +74,9 @@ Override / extend via `PWN::Env[:ai][:agent][:extrospection][:web][:anchors]`; s
 | Tool | Does | Persists to |
 |---|---|---|
 | `extro_snapshot` | Fingerprint host/net/toolchain/repo/env/**rf**/*web* → hash | `extrospection.json` (`snapshot` + rotates `previous`) |
-| `extro_drift` | Diff live-vs-stored (or stored-vs-previous) | — returns `{changed, added, removed}` with dotted keys |
-| `extro_observe` | Record a fact — `category:` one of `recon vuln intel target network env` **`rf` `web` `osint` `serial` `telecomm` `packet` `vision` `voice`** `misc` | `observations[]` |
-| `extro_observations` | Query recorded facts by source/category/target/tag | — |
+| `extro_drift` | Diff live-vs-stored (or stored-vs-previous) | - returns `{changed, added, removed}` with dotted keys |
+| `extro_observe` | Record a fact - `category:` one of `recon vuln intel target network env` **`rf` `web` `osint` `serial` `telecomm` `packet` `vision` `voice`** `misc` | `observations[]` |
+| `extro_observations` | Query recorded facts by source/category/target/tag | - |
 | `extro_intel` | Query NVD / CIRCL / Exploit-DB for keyword or CVE | optional `record: true` → `:intel` observations |
 | **`extro_watch`** | **Render a URL headless, hash the *rendered* DOM, screenshot, diff vs prior** | `observations[]` (`category: :web`) |
 | **`extro_verify`** | **Browser-backed self fact-check of a claim (`:cve` `:version` `:doc` `:generic`) → `:confirmed`/`:refuted`/`:unknown`** | `Mistakes.record` / `observe(:intel)` / `Learning.note_outcome` |
@@ -87,12 +87,12 @@ Override / extend via `PWN::Env[:ai][:agent][:extrospection][:web][:anchors]`; s
 | **`extro_packet`** | **Inventory · bounded live capture · pcap summarise (tshark/PacketFu)** | `observations[]` (`category: :packet`) |
 | **`extro_vision`** | **OCR (tesseract/RTesseract) · barcode/QR (zbarimg)** | `observations[]` (`category: :vision`) |
 | **`extro_voice`** | **TTS (espeak-ng/festival/spd-say) · STT (whisper) · inventory** | `observations[]` (`category: :voice`) |
-| `extro_correlate` | **Join** introspection ↔ extrospection | — actionable findings |
-| `extro_stats` | snapshot age · observation count · drift counts · **rf_devices** · **web_anchors** | — |
-| `extro_reset` | Wipe snapshot + observations (new engagement) | — |
+| `extro_correlate` | **Join** introspection ↔ extrospection | - actionable findings |
+| `extro_stats` | snapshot age · observation count · drift counts · **rf_devices** · **web_anchors** | - |
+| `extro_reset` | Wipe snapshot + observations (new engagement) | - |
 | `extro_auto_toggle` | Enable/disable ambient baseline (`AUTO_SECTIONS` only) after every final answer | `PWN::Env[:ai][:agent][:auto_extrospect]` |
 
-## `extro_correlate` — the point of the whole thing
+## `extro_correlate` - the point of the whole thing
 
 ```text
 (a) Metrics tools with <50 % success   ×  toolchain drift / missing binaries
@@ -106,11 +106,11 @@ Override / extend via `PWN::Env[:ai][:agent][:extrospection][:web][:anchors]`; s
 
 Output tells the agent whether a failure was **its own fault** ("I called the
 API wrong" → belongs in [Mistakes](Mistakes.md)) or **the world changed**
-("nmap was upgraded and the flag moved", "the HackRF was unplugged") — and
+("nmap was upgraded and the flag moved", "the HackRF was unplugged") - and
 that distinction is written back into MEMORY so the next run doesn't waste
 iterations rediscovering it.
 
-## `extro_verify` — proactive fact-checking (the browser as a sense organ)
+## `extro_verify` - proactive fact-checking (the browser as a sense organ)
 
 `probe_rf` is a passive **ear inventory**; `extro_rf_tune` actually **listens** (tune + RDS). `PWN::Plugins::TransparentBrowser` gives Extrospection **eyes**. `extro_verify(claim:)` renders a canonical source *with JavaScript
 executed* and returns a verdict:
@@ -123,7 +123,7 @@ executed* and returns a verdict:
 | `:generic` | DuckDuckGo HTML (proxy-able, no API key) | ≥ 50 % token overlap in top result snippets |
 
 ```text
-                  ┌── :refuted  → Mistakes.record(tool:'assumption', …)  → KNOWN MISTAKES block ∀ future runs
+                  ┌── :refuted  → Mistakes.record(tool:'assumption', ...)  → KNOWN MISTAKES block ∀ future runs
 extro_verify ─────┼── :confirmed→ observe(category::intel, ttl:30d)      → EXTROSPECTION block, freshness-bound
                   └── :unknown  → Learning.note_outcome(tags:[needs_human])
 ```
@@ -134,13 +134,13 @@ This adds a **proactive** trigger to the negative-feedback loop: today
 the world **before** a human does. `commit: false` returns the verdict without
 side-effects.
 
-## `extro_rf_tune` — the radio as a sense organ
+## `extro_rf_tune` - the radio as a sense organ
 
 `probe_rf` is a **passive inventory** (what radios are attached / is GQRX
-listening?). `extro_rf_tune` is the **active RF sense organ** — the radio
+listening?). `extro_rf_tune` is the **active RF sense organ** - the radio
 analogue of `extro_watch` / `extro_verify`. It never launches GQRX (presence-
 only bin); it connects to an already-running remote-control socket, tunes,
-demodulates, measures strength, and — for FM broadcast — samples RDS:
+demodulates, measures strength, and - for FM broadcast - samples RDS:
 
 ```text
 extro_rf_tune(freq: "101.1")
@@ -148,7 +148,7 @@ extro_rf_tune(freq: "101.1")
   → M WFM_ST 200000 ; F 101100000
   → sample RDS for settle_secs (default 8s)
   → { ok, freq, strength_dbfs, station, now_playing, rds:{pi,ps_name,radiotext}, summary }
-  → observe(category: :rf, ttl: 300)   # ephemeral — songs change
+  → observe(category: :rf, ttl: 300)   # ephemeral - songs change
 ```
 
 RDS sampling is **`PWN::SDR::Decoder::RDS.sample`** (non-interactive Hash:
@@ -164,7 +164,7 @@ Frequency parsing is free-form: `"101.1"`, `"101.1 FM"`, `"101.1 MHz"`,
 etc.). Override with `demodulator_mode:` / `bandwidth:` / `rds:`.
 
 Requires GQRX remote control listening and an SDR attached; returns
-`{ok:false, advice:…}` with a concrete recovery hint otherwise. Configure:
+`{ok:false, advice:...}` with a concrete recovery hint otherwise. Configure:
 
 ```ruby
 PWN::Env[:ai][:agent][:extrospection][:rf] = {
@@ -172,12 +172,12 @@ PWN::Env[:ai][:agent][:extrospection][:rf] = {
 }
 ```
 
-## `extro_osint` — OSINT sense organ
+## `extro_osint` - OSINT sense organ
 
 Aggregates as many **public / free** OSINT APIs as practical into one verb.
 Optional keyed feeds (Shodan / Hunter) unlock when `SHODAN_API_KEY` /
-`HUNTER_API_KEY` or `PWN::Env` keys are present. Every feed is best-effort —
-unreachable endpoints return `{error:…}` instead of raising.
+`HUNTER_API_KEY` or `PWN::Env` keys are present. Every feed is best-effort -
+unreachable endpoints return `{error:...}` instead of raising.
 
 ### Auto-detected kinds
 
@@ -186,14 +186,14 @@ unreachable endpoints return `{error:…}` instead of raising.
 | `:ip` | IPv4 / IPv6 | ip · geo · ipapi_is · iplocate · ipwhois · dns · rdap · bgpview · otx · abuseipdb · greynoise · shodan · hackertarget |
 | `:geo` | street-like address / geo query | geo · nominatim · ip |
 | `:domain` / `:dns` / `:whois` / `:rdap` | FQDN | dns · whois · rdap · crtsh · certspotter · wayback · otx · urlhaus · urlscan · shodan · securitytrails · hackertarget |
-| `:url` | `http(s)://…` | urlscan · otx · urlhaus · wayback · microlink · virustotal |
+| `:url` | `http(s)://...` | urlscan · otx · urlhaus · wayback · microlink · virustotal |
 | `:email` | `a@b.c` | hunter · person · github · haveibeenpwned |
 | `:phone` | E.164 / NANP | phone · person |
 | `:fcc_id` | `2ABIP-ESP32` style | fcc_id |
-| `:patent` | `US10123456` / `patent …` | patent |
+| `:patent` | `US10123456` / `patent ...` | patent |
 | `:person` | `Jane Doe` | person · username · github · open_sanctions · agify · genderize · nationalize · vital_records |
 | `:username` / `:github` | `@handle` / `gh:` | username · github |
-| `:company` | `… Inc.` / `LLC` / `Ltd` | opencorporates · sec_edgar · federal_register · person · courtlistener |
+| `:company` | `... Inc.` / `LLC` / `Ltd` | opencorporates · sec_edgar · federal_register · person · courtlistener |
 | `:cik` | 10-digit CIK | sec_edgar · opencorporates |
 | `:vital_records` | birth/death/marriage keywords | vital_records · person |
 | `:threat` | forced | otx · urlhaus · threatfox · abuseipdb · greynoise · virustotal · epss · cisa_kev |
@@ -204,7 +204,7 @@ unreachable endpoints return `{error:…}` instead of raising.
 | `:npi` | `NPI 1679576722` (prefixed) | nppes |
 | `:cve` | `CVE-YYYY-NNNN` | epss · cisa_kev |
 
-### Public feed catalogue (no key unless noted)
+### Public feed catalog (no key unless noted)
 
 | Feed | Sources | Notes |
 |---|---|---|
@@ -236,8 +236,8 @@ unreachable endpoints return `{error:…}` instead of raising.
 | `:ipapi_is` | api.ipapi.is | IP company/ASN/hosting/proxy/crawler flags (free) |
 | `:iplocate` | iplocate.io | IP geo + threat (proxy/VPN/hosting) |
 | `:ipwhois` | ipwho.is | Free IP geo / connection / timezone |
-| `:abuseipdb` | api.abuseipdb.com | IP reputation — **needs** `ABUSEIPDB_API_KEY` |
-| `:virustotal` | virustotal.com API v3 | URL/domain/IP analysis — **needs** `VIRUSTOTAL_API_KEY` |
+| `:abuseipdb` | api.abuseipdb.com | IP reputation - **needs** `ABUSEIPDB_API_KEY` |
+| `:virustotal` | virustotal.com API v3 | URL/domain/IP analysis - **needs** `VIRUSTOTAL_API_KEY` |
 | `:greynoise` | greynoise.io community / v2 | Internet scanner noise (community free; key upgrades) |
 | `:certspotter` | api.certspotter.com | Certificate Transparency issuances |
 | `:epss` | api.first.org/data/v1/epss | Exploit Prediction Scoring System for a CVE |
@@ -245,14 +245,14 @@ unreachable endpoints return `{error:…}` instead of raising.
 | `:nhtsa` | vpic.nhtsa.dot.gov + `PWN::Plugins::VIN` | VIN decode / make-model |
 | `:nppes` | npiregistry.cms.hhs.gov | US healthcare NPI provider lookup |
 | `:federal_register` | federalregister.gov API | US Federal Register document search |
-| `:uk_police` | data.police.uk | UK street-level crime / force catalogue |
+| `:uk_police` | data.police.uk | UK street-level crime / force catalog |
 | `:callook` | callook.info | US amateur-radio callsign (FCC ULS) |
 | `:mac_vendor` | maclookup.app · macvendors.com | MAC OUI → vendor |
 | `:universities` | universities.hipolabs.com | University name / domain / country |
 | `:microlink` | api.microlink.io | Link unfurl (OG title/desc/image) |
 | `:agify` / `:genderize` / `:nationalize` | agify.io · genderize.io · nationalize.io | First-name age/gender/nationality estimates |
-| `:haveibeenpwned` | haveibeenpwned.com v3 | Breach membership — **needs** `HIBP_API_KEY` |
-| `:securitytrails` | api.securitytrails.com | Domain DNS history — **needs** `SECURITYTRAILS_API_KEY` |
+| `:haveibeenpwned` | haveibeenpwned.com v3 | Breach membership - **needs** `HIBP_API_KEY` |
+| `:securitytrails` | api.securitytrails.com | Domain DNS history - **needs** `SECURITYTRAILS_API_KEY` |
 
 > Feed selection inspired by [public-api-lists/public-api-lists](https://github.com/public-api-lists/public-api-lists) (Anti-Malware, Security, Geocoding, Government, Health, Open Data, Vehicle, Development).
 
@@ -302,13 +302,13 @@ Configure:
 PWN::Env[:ai][:agent][:extrospection][:osint] = {
   ttl: 86_400,
   api_keys: {
-    shodan: '…',
-    hunter: '…',
-    abuseipdb: '…',
-    virustotal: '…',
-    greynoise: '…',
-    haveibeenpwned: '…',
-    securitytrails: '…'
+    shodan: '...',
+    hunter: '...',
+    abuseipdb: '...',
+    virustotal: '...',
+    greynoise: '...',
+    haveibeenpwned: '...',
+    securitytrails: '...'
   }
 }
 # ENV fallbacks also accepted:
@@ -317,7 +317,7 @@ PWN::Env[:ai][:agent][:extrospection][:osint] = {
 ```
 
 
-## `extro_serial` — Serial sense organ
+## `extro_serial` - Serial sense organ
 
 Passive inventory via `snapshot(sections: [:serial])` (`/dev/ttyUSB*`,
 `/dev/ttyACM*`, `/dev/serial/by-id/*`). The active verb opens a device through
@@ -331,7 +331,7 @@ extro_serial(block_dev: "/dev/ttyUSB0", baud: 115200, payload: "ATI\r")
   → observe(category: :serial)
 ```
 
-## `extro_telecomm` — SIP / VoIP / PSTN sense organ
+## `extro_telecomm` - SIP / VoIP / PSTN sense organ
 
 Telecomm analogue of `extro_rf_tune`. Talks to a **running** BareSIP HTTP
 control socket (never launches it). Actions:
@@ -339,7 +339,7 @@ control socket (never launches it). Actions:
 | action | Effect |
 |---|---|
 | `:inventory` / `:status` | bins · SIP listen ports · BareSIP HTTP reachability · status text |
-| `:dial` | require `target:` SIP URI or E.164 — **OPSEC: real call** |
+| `:dial` | require `target:` SIP URI or E.164 - **OPSEC: real call** |
 | `:hangup` | hang up active call |
 
 ```ruby
@@ -348,7 +348,7 @@ PWN::Env[:ai][:agent][:extrospection][:telecomm] = {
 }
 ```
 
-## `extro_packet` — Packet sense organ
+## `extro_packet` - Packet sense organ
 
 Bounded L2/L3 sensing via `tshark` / `tcpdump` + pcap summarisation through
 `PWN::Plugins::Packet` / tshark hierarchy & conversations:
@@ -362,7 +362,7 @@ Bounded L2/L3 sensing via `tshark` / `tcpdump` + pcap summarisation through
 Capture is hard-capped (`count` ≤ 200, `timeout` ≤ 60s) so the agent never
 hangs mid-turn.
 
-## `extro_vision` — Vision / OCR sense organ
+## `extro_vision` - Vision / OCR sense organ
 
 Eyes on the host:
 
@@ -377,7 +377,7 @@ extro_vision(file: "/tmp/shot.png", action: :ocr)
   → { text, chars, preview } → observe(category: :vision)
 ```
 
-## `extro_voice` — Voice (TTS / STT) sense organ
+## `extro_voice` - Voice (TTS / STT) sense organ
 
 | action | Backend |
 |---|---|
@@ -385,9 +385,9 @@ extro_vision(file: "/tmp/shot.png", action: :ocr)
 | `:stt` | OpenAI whisper binary / `PWN::Plugins::Voice.speech_to_text` |
 | `:inventory` | VOICE_BINS presence |
 
-Artefacts land under `~/.pwn/extrospection/voice/`.
+Artifacts land under `~/.pwn/extrospection/voice/`.
 
-## `revalidate_memory` — the browser as GC for `PWN::Memory`
+## `revalidate_memory` - the browser as GC for `PWN::Memory`
 
 
 `learning_consolidate` only dedupes/truncates; it never asks *"is this still
@@ -405,8 +405,8 @@ cron_create(name: 'memory_revalidate', schedule: '0 4 * * 0',
 
 ```ruby
 PWN::Env[:ai][:agent][:extrospection][:web] = {
-  anchors:          ['https://target.acme/api/version', …],  # else DEFAULT_WEB_ANCHORS
-  proxy:            'tor',      # or 'http://127.0.0.1:8080' (Burp) — honoured by verify/watch/probe_web
+  anchors:          ['https://target.acme/api/version', ...],  # else DEFAULT_WEB_ANCHORS
+  proxy:            'tor',      # or 'http://127.0.0.1:8080' (Burp) - honoured by verify/watch/probe_web
   max_anchors:      8,
   per_page_timeout: 15,
   screenshot:       false,      # → ~/.pwn/extrospection/web/<host>.png
@@ -420,11 +420,11 @@ PWN::Env[:ai][:agent][:extrospection][:web] = {
 ```ruby
 extro_reset(confirm: true)             # clean slate for new scope
 extro_snapshot                         # baseline (host/net/toolchain/repo/env/rf; add sections:%i[web] for anchors)
-# … recon …
+# ... recon ...
 extro_observe(source: 'nmap', target: '10.0.0.5',
               category: 'recon', data: 'OpenSSH 8.2p1 Ubuntu')
 extro_observe(source: 'gqrx', target: '433.920MHz',
-              category: 'rf', data: 'peak -34.2 dBFS bw=200k FSK — likely garage remote')
+              category: 'rf', data: 'peak -34.2 dBFS bw=200k FSK - likely garage remote')
 extro_rf_tune(freq: '101.1')           # live RDS → now_playing / station (category: :rf)
 extro_osint(query: '10.0.0.5', kind: :ip)
 extro_osint(query: '2ABIP-ESP32', kind: :fcc_id)
@@ -435,149 +435,159 @@ extro_voice(action: :tts, text: 'recon complete')
 extro_intel(query: 'OpenSSH 8.2p1', record: true)
 extro_watch(url: 'https://target.acme/api/version')       # DOM-hash + screenshot; changed:true on next run
 extro_verify(claim: 'CVE-2026-12345 affects OpenSSL 3.2.1')  # → Mistakes/Memory/observe on verdict
-# … days later, something breaks …
+# ... days later, something breaks ...
 extro_drift                            # what moved?
 extro_correlate                        # why did it break?
 ```
 
 ## Example questions that trigger Extrospection
 
-Natural-language prompts that should fire **outward** sensing (grouped by sense organ).
-Location-specific details use **Chicago** as the canonical city so the catalog stays
-portable across deployments.
-
-### RF sense organ (`extro_rf_tune` + RF observations)
-
-- “What’s playing on 101.1 right now?”
-- “What’s on Q101 / 101.1 FM in Chicago?”
-- “Is NOAA weather radio for the Chicago area broadcasting an alert?”
-- “Tune 433.92 MHz and report signal strength.”
-- “Any ADS-B traffic near Chicago O’Hare (ORD) right now?”
-- “Sample RDS on 93.1 for 15 seconds — station name and radiotext?”
-- “Is the local Chicago 2 m repeater on 146.x active?”
-
-### Web sense organ (`extro_watch`, `extro_verify`, `snapshot(sections: [:web])`)
-
-- “Did the vendor status page change since last check?”
-- “Watch https://status.example.com for DOM changes.”
-- “Has the bug-bounty scope page been updated?”
-- “What’s the weather in Chicago today?” *(live external page)*
-- “Fingerprint that login portal’s generator / title / tech stack.”
-- “Screenshot + hash https://target/app/version for drift tracking.”
+Natural-language prompts that should route to **outward** sensing rather than
+introspection. These are phrased the way an offensive security researcher
+actually asks them mid-engagement - attack-surface discovery, zero-day
+hunting, hardware/RF poking, and disclosure prep. Location-specific examples
+use **Chicago** so the catalog stays portable.
+
+### RF / SDR sense organ (`extro_rf_tune` + `:rf` observations)
+
+- "Tune 433.92 MHz - is the target's garage/gate remote fixed-code or rolling?"
+- "Sweep the 900 MHz ISM band near the badge reader and log anything > −40 dBFS."
+- "What's broadcasting on 101.1 FM right now - grab RDS PI/PS so we can prove SDR is live."
+- "Sample 868.3 MHz for 15 s - does the smart-meter mesh look like Wireless M-Bus?"
+- "Any ADS-B traffic squawking over the client's campus (near ORD)?"
+- "Listen on the pager band (929.x MHz) - are unencrypted POCSAG pages leaking PHI?"
+- "Is the site's DMR/TETRA handheld traffic on 462.x actually encrypted?"
+- "Park on 315 MHz and tell me if the target's TPMS / key-fob replays cleanly."
+
+### Web / browser sense organ (`extro_watch`, `extro_verify`, `snapshot(sections: [:web])`)
+
+- "Watch the target's `/api/version` endpoint - alert me the moment the build string changes."
+- "Has the vendor silently patched? Diff today's changelog DOM against our last hash."
+- "Did the bug-bounty scope page add or drop assets since we baselined it?"
+- "Fingerprint the login portal's JS bundle - framework, version, source-map leakage."
+- "Screenshot + DOM-hash the admin panel so we can prove pre-auth state for the report."
+- "Render the CSP/`.well-known/security.txt` and tell me who to disclose to."
+- "Has the target's TLS cert or issuer rotated since the last watch?"
 
 ### OSINT sense organ (`extro_osint`)
 
-- “Reverse lookup +1 312 555 1212.”
-- “Who is the registrant for example.com?”
-- “What device is FCC ID 2ABIP-ESP32?”
-- “Find patents related to software-defined radio receivers.”
-- “Pivot on username @octocat across GitHub/GitLab/Reddit.”
-- “Is Jane Doe listed on OpenSanctions / Wikipedia?”
-- “CT certs for target.acme via crt.sh.”
-- “ASN / BGP neighbours for 1.1.1.1.”
-- “Any Wayback snapshots of https://target.acme/login?”
+- "Enumerate every subdomain for `*.target.tld` via CT logs (crt.sh + CertSpotter)."
+- "Who owns AS-XXXXX and what netblocks does it announce - expand our in-scope ranges."
+- "Pull EPSS + CISA KEV for CVE-2024-3094 - is this worth weaponising first?"
+- "What's Shodan / GreyNoise saying about `203.0.113.10` - already mass-exploited?"
+- "Decode this VIN off the fleet vehicle - what telematics head-unit ships in that trim?"
+- "FCC ID `2ABIP-...` on the IoT doorbell - pull the internal photos and RF test report."
+- "MAC OUI `AC:DE:48` on the rogue AP - which vendor, and do they have default creds?"
+- "Any prior litigation or SEC 8-K breach filings for `Target Corp` before we disclose?"
+- "Wayback the old `/admin` path - did an earlier deploy expose a debug console?"
+- "Pivot `@lead-dev` across GitHub/GitLab - hardcoded secrets in personal repos?"
 
-### Serial sense organ (`extro_serial`)
+### Serial / hardware sense organ (`extro_serial`)
 
-- “What USB serial devices are attached?”
-- “Send ATI to the modem on /dev/ttyUSB0 and show the banner.”
-- “Talk to the Flipper / RFID reader on ttyACM and dump response hex.”
-- “Probe the Arduino console at 115200 8N1.”
+- "What just enumerated on `/dev/ttyUSB*` when I plugged in the router's UART header?"
+- "Send `AT+GMR` to the ESP32 on `/dev/ttyUSB0` - firmware version and SDK build?"
+- "Dump the boot banner at 115200 8N1 - does it drop to an unauthenticated U-Boot shell?"
+- "Probe the Flipper on `ttyACM0` and pull the last captured Sub-GHz raw."
+- "Talk to the smart-lock's BLE-UART bridge and echo back whatever it volunteers."
 
-### Telecomm sense organ (`extro_telecomm`)
+### Telecomm / VoIP sense organ (`extro_telecomm`)
 
-- “Is BareSIP running and what is its status?”
-- “List SIP ports listening on this host.”
-- “Dial sip:echo@example.com via BareSIP.” *(OPSEC: real call)*
-- “Hang up the active VoIP call.”
+- "Is BareSIP registered to the client's PBX, and what codecs did it negotiate?"
+- "Enumerate SIP `OPTIONS` against the exposed SBC - does it leak `User-Agent`/version?"
+- "Dial the IVR at `sip:ivr@target` and record the prompt tree for the social-eng playbook." *(OPSEC: real call)*
+- "Hang up and note whether the PBX exposed internal extension ranges in the `BYE`."
 
 ### Packet sense organ (`extro_packet`)
 
-- “Inventory capture-capable interfaces and tshark/tcpdump.”
-- “Capture 20 packets on eth0 for tcp/443 and summarise.”
-- “Summarise this pcap: /tmp/eng.pcap.”
-- “What IP conversations dominate that capture?”
+- "Capture 30 s on `eth0` while I trigger the IoT hub - what does it phone home to?"
+- "Summarise `/tmp/eng.pcap` - top talkers, cleartext creds, weird ports."
+- "BPF `udp port 5353` - is mDNS leaking hostnames and service records on the guest VLAN?"
+- "Grab 50 packets of the OT segment - Modbus/TCP or something proprietary?"
+- "Do we see the camera's RTSP creds in the clear during that capture?"
 
 ### Vision / OCR sense organ (`extro_vision`)
 
-- “OCR this screenshot of the login page.”
-- “Decode the QR code on /tmp/badge.png.”
-- “What languages does tesseract have installed?”
+- "OCR the photo of the switch label - model, firmware, and default-cred sticker."
+- "Decode the QR on the badge printer - is that a provisioning URL with an embedded token?"
+- "OCR the BIOS/BMC screenshot and pull the exact firmware build for CVE matching."
+- "Read the barcode on the HSM - serial + part number for supply-chain lookup."
 
 ### Voice sense organ (`extro_voice`)
 
-- “Speak ‘engagement complete’ via TTS.”
-- “Transcribe /tmp/voicemail.wav.”
-- “What TTS/STT engines are available on this host?”
+- "Transcribe `/tmp/voicemail.wav` - did the helpdesk leak the temp-password format?"
+- "STT the recorded IVR tree so we can grep it for extension numbers."
+- "TTS this vishing pretext to a `.wav` for the approved social-engineering call."
+- "Which STT/TTS engines are installed - can we run whisper offline on the drop box?"
 
 ### Fact-check / claim verification (`extro_verify`)
 
-- “Is CVE-2024-3094 still rated Critical on NVD?”
-- “Confirm the latest `pwn` gem on RubyGems is 0.5.x.”
-- “Is it true that OpenSSH 9.8p1 is the current stable?”
-- “Verify this claim from the advisory against the official page.”
-- “Does that docs page actually say what we quoted?”
+- "Before I file this: does CVE-2024-3094 actually list our target's distro package as affected?"
+- "Confirm the latest upstream OpenSSH is 9.x - is the target's 8.2p1 genuinely EOL?"
+- "Verify the vendor advisory URL really says 'remote unauthenticated' - quote it back."
+- "Is `pwn` on RubyGems still at the version we ship in the report appendix?"
+- "Fact-check my claim that this library has no maintained fork - search says otherwise?"
 
 ### Threat intel (`extro_intel` ± `record:true`)
 
-- “Any known exploits for Apache 2.4.58?”
-- “Look up CVE-2025-XXXX across NVD / CIRCL / Exploit-DB.”
-- “What CVEs hit `libssl` in the last year?”
-- “Is there a public PoC for that JetBrains CVE?”
-- “Correlate installed nmap version against known CVEs.”
+- "Any public PoC or Exploit-DB entry for the exact `nginx 1.25.3` build we bannered?"
+- "Pull NVD + CIRCL for `libwebp` since 2023 - which are pre-auth RCE vs local?"
+- "Cross-ref this router's firmware components against known-exploited (KEV)."
+- "What's the newest CVE touching `Fortinet FortiOS` and is there an exploit module yet?"
+- "Record everything for `Apache Struts` so `extro_correlate` can match our target stack."
 
 ### Host / env / toolchain drift (`extro_snapshot`, `extro_drift`, `extro_stats`)
 
-- “Did the environment change under us since last session?”
-- “Take a full extrospection snapshot and show drift.”
-- “Is nmap / gqrx / SoapySDR still the version we expect?”
-- “What’s listening on this host right now?”
-- “Show toolchain + repo HEAD fingerprint.”
-- “Why did that tool start failing — world drift or operator error?” → pairs with `extro_correlate`
+- "Snapshot the drop box before we start - I want a defensible 'this is what we brought' baseline."
+- "Did anything on this attack host change overnight (kernel, nmap, listening ports)?"
+- "Which offensive bins are actually present in PATH on this jump host?"
+- "Is the SDR / HackRF still attached, or did the USB hub flake again?"
+- "Show repo HEAD + dirty state so the finding is reproducible from a commit hash."
 
 ### Recon memory / observations (`extro_observe`, `extro_observations`)
 
-- “Remember that target X bannered as nginx/1.25.3 on 443.”
-- “What recon findings do we have for 10.0.0.5?”
-- “List RF observations from today.”
-- “Any :web watches that changed this week?”
-- “Show intel hits we recorded against this product.”
+- "Remember: `10.0.0.5:8443` self-signed CN leaks internal AD domain - tag `recon,pivot`."
+- "Log the RF finding: 433.92 MHz fixed-code, 24-bit, replayable - tag `rf,physical`."
+- "What have we already observed about `*.target.tld` this engagement?"
+- "List every `:intel` observation still fresh so I don't re-run the same CVE queries."
+- "Which `:web` watches flipped `changed:true` this week - silent patch candidates?"
 
-### Correlation / “am I wrong or did the world move?” (`extro_correlate`)
+### Correlation - "am I wrong or did the world move?" (`extro_correlate`)
 
-- “Cross-check recent tool failures against host/toolchain drift.”
-- “Did any of our recorded CVEs match installed package versions?”
-- “Is that failed shell call explained by missing binaries?”
-- “Any refuted claims that should invalidate old memory facts?”
+- "My exploit stopped landing - did the target's DOM/TLS drift or did I break the payload?"
+- "Cross recorded CVE intel against the versions we actually bannered on scope hosts."
+- "Are any of my `PWN::Memory` facts about this target now refuted by fresh `extro_verify` runs?"
+- "Do the `nmap`/`msf` failures line up with a toolchain upgrade rather than operator error?"
+- "Which watched anchors went unreachable - down-weight intel sourced from them."
 
 ### Operational / lifecycle
 
-- “Enable ambient auto-extrospect after every answer.”
-- “Reset extrospection for a new engagement.” *(destructive)*
-- “How stale is the current world snapshot?”
-- “Toggle auto-extrospect off while we fuzz.”
+- "New engagement, new client - wipe extrospection so old recon doesn't bleed into this report." *(destructive)*
+- "Turn ambient auto-extrospect **off** while I fuzz - I don't want baseline noise per turn."
+- "How stale is our world snapshot - is it still from the pre-patch window?"
+- "Re-enable auto-extrospect for the wrap-up so drift is captured in the final deliverable."
 
-### Short “trigger” patterns the agent should recognize
+### Short trigger patterns the agent should recognize
 
 | Pattern | Likely tools |
-|--------|----------------|
-| “What’s on … MHz / FM / station” | `extro_rf_tune` |
-| “Reverse phone / FCC ID / patent / whois / person” | `extro_osint` |
-| “Serial / AT modem / ttyUSB / Flipper console” | `extro_serial` |
-| “SIP / VoIP / BareSIP / dial” | `extro_telecomm` |
-| “Capture packets / summarise pcap” | `extro_packet` |
-| “OCR / barcode / QR this image” | `extro_vision` |
-| “Speak this / transcribe that audio” | `extro_voice` |
-| “Did … page change / watch URL” | `extro_watch` |
-| “Is it true that… / confirm CVE / latest version” | `extro_verify` |
-| “Known vulns / CVE / exploit for…” | `extro_intel` |
-| “What changed on this host / drift” | `extro_snapshot` + `extro_drift` |
-| “Remember this finding about…” | `extro_observe` |
-| “Why did X start failing?” | `extro_correlate` + metrics/mistakes |
-| “Weather in Chicago / public page content” | `extro_watch` / TransparentBrowser |
+|---|---|
+| "tune / MHz / FM / RDS / ISM / key-fob / pager / ADS-B" | `extro_rf_tune` |
+| "subdomain / CT log / ASN / whois / FCC ID / VIN / MAC OUI / EPSS / KEV / Wayback / pivot @user" | `extro_osint` |
+| "UART / ttyUSB / U-Boot / AT command / Flipper / JTAG banner" | `extro_serial` |
+| "SIP / PBX / IVR / BareSIP / dial / hangup" | `extro_telecomm` |
+| "capture on iface / summarise pcap / mDNS / Modbus / RTSP creds" | `extro_packet` |
+| "OCR sticker / decode QR / read badge / BIOS screenshot" | `extro_vision` |
+| "transcribe wav / TTS pretext / whisper offline" | `extro_voice` |
+| "watch URL / did the page change / silent patch / scope updated / TLS rotated" | `extro_watch` |
+| "is it true that / confirm CVE / verify advisory / latest version of" | `extro_verify` |
+| "known exploits for / any PoC / CVEs affecting / KEV for" | `extro_intel` |
+| "what changed on this host / baseline the box / SDR still attached" | `extro_snapshot` + `extro_drift` |
+| "remember this finding / what did we observe about / tag it recon" | `extro_observe` / `extro_observations` |
+| "why did X stop working / my fault or theirs / down-weight that source" | `extro_correlate` |
+| "new engagement clean slate / stop baselining while I fuzz" | `extro_reset` / `extro_auto_toggle` |
 
 The **inward** half of the loop (Memory · Skills · Learning · Mistakes · Metrics)
-has a matching example catalog in [Skills, Memory & Learning](Skills-Memory-Learning.md#example-questions-that-trigger-introspection).
+has a matching example catalog in
+[Skills, Memory & Learning](Skills-Memory-Learning.md#example-questions-that-trigger-introspection).
 
 **See also:** [Skills, Memory & Learning](Skills-Memory-Learning.md) ·
 [Mistakes](Mistakes.md) · [SDR](SDR.md) · [Transparent Browser](Transparent-Browser.md) · [Cron](Cron.md) · [pwn-ai Agent](pwn-ai-Agent.md)