pwn 0.5.682 → 0.5.684

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8f46629cb3abad0974a4fe9bd5d2936bb42c90e304986261cf0106775ffb8de9
-  data.tar.gz: 56fc226ba599b541c47e66c38f7e3a6d142c019442a00707db8f9d8d12caee74
+  metadata.gz: ea35094f56adb31f1af096c634b0a027aa16825fe596ed34165b1efc0627c279
+  data.tar.gz: 42bedb6ce050206f988a3df3d99c84d39896e63ec54d453aa0d625e763600b9e
 SHA512:
-  metadata.gz: aadc0dad32c3ac362ee269637c0308a1f89e400c311dd5b69d9a7c2e944cc57698799c85b97c51ea3024207f18703b32735faacf394a7d2e3f91e6945efb724e
-  data.tar.gz: 748bedcea767a060882928c3697cc96a3ffa5f316cbca209d7e4dc870bcbaef6737ebb582d86b76dcd9c5f6624cd46c6d646b94dec8f0dbcd20af9a1cc0bbdf9
+  metadata.gz: da7066b555f86266d022850351074fd8ce266254e746c80f13a84fd631a71040d7e122c6fb1ccbd9ef5c93225b40c22a99651bfb35a05ae26bd60dd56d0208b7
+  data.tar.gz: de4d5212171f9bb84122a9141203851245a8fa4e4ca01eb127992b9fce505de4aeb15ed7812cd03bc6aaf71248cfa389fdb41ee280460f24ed7f56b8245b1d77

data/README.md

@@ -33,9 +33,9 @@ can run those same methods for you.
 Red teamers, pentesters, and vulnerability researchers get one place to script
 and automate instead of gluing together a pile of separate CLIs.
 
-**In numbers:** 66 `PWN::Plugins` · 48 `PWN::SAST` rules · 90 `PWN::AWS`
-service wrappers · 22 `PWN::WWW` site drivers · 53 `bin/pwn_*` CLI drivers ·
-6 LLM engines · 13 agent toolsets · 85 LLM-callable tools.
+**In numbers:** 67 `PWN::Plugins` · 48 `PWN::SAST` modules · 90 `PWN::AWS`
+service wrappers · 22 `PWN::WWW` site drivers · 54 executables (`pwn` + 53 `bin/pwn_*`) ·
+6 LLM engines · 13 agent toolsets · 87 LLM-callable tools.
 
 Full page: [What is PWN](documentation/What-is-PWN.md)
 
@@ -119,11 +119,12 @@ message bus:
 ![Swarm Multi-Agent](documentation/diagrams/swarm-multi-agent.svg)
 
 Long-running turns also show **executive task briefs** (not raw commands) via
-`TaskSummarizer`. Every request is first classified as a **general statement**,
-a **question**, or an **autonomous goal**. Only autonomous goals get a multi-step
-breakdown on submit (`emit_plan!`); statements and questions stay single-turn.
-Per-batch `about_to` lines use `tool_counts_phrase` + `intent_phrase` with
-`last_brief_fp` duplicate suppression. When recent turns keep hitting the iteration ceiling, the Loop tightens the remaining runway (lower `max_iters` on local engines, text-only tail, no counterfactual fork) so the agent still finishes instead of thrashing.
+`TaskSummarizer`. There is no request type. Every request gets an English
+task compass (`emit_plan!` on submit, `about_to` as `task k/n` before each
+tool batch). Duplicate briefs are suppressed. Budget-hot turns skip extra
+counterfactual forks and only strip tools on the last iteration when the
+original request is already satisfied. Yesterday's scars do not lower this
+request's `max_iters` (default 777).
 
 Full pages: [How PWN Works](documentation/How-PWN-Works.md) ·
 [All data-flow diagrams](documentation/Diagrams.md)
@@ -136,9 +137,9 @@ The complete wiki lives in this repo at **[`documentation/Home.md`](documentatio
 
 | Start Here | Entry Points | AI Subsystem | Capabilities |
 |---|---|---|---|
-| [What is PWN](documentation/What-is-PWN.md) | [`pwn` REPL](documentation/pwn-REPL.md) | [AI / LLM Integration](documentation/AI-Integration.md) | [Plugins (66)](documentation/Plugins.md) |
+| [What is PWN](documentation/What-is-PWN.md) | [`pwn` REPL](documentation/pwn-REPL.md) | [AI / LLM Integration](documentation/AI-Integration.md) | [Plugins (67)](documentation/Plugins.md) |
 | [Why PWN](documentation/Why-PWN.md) | [`pwn-ai` Agent](documentation/pwn-ai-Agent.md) | [Agent Tool Registry](documentation/Agent-Tool-Registry.md) | [SAST (48)](documentation/SAST.md) |
-| [How PWN Works](documentation/How-PWN-Works.md) | [CLI Drivers (53)](documentation/CLI-Drivers.md) | [Memory · Skills · Learning](documentation/Skills-Memory-Learning.md) | [AWS (90)](documentation/AWS.md) |
+| [How PWN Works](documentation/How-PWN-Works.md) | [CLI Drivers (54)](documentation/CLI-Drivers.md) | [Memory · Skills · Learning](documentation/Skills-Memory-Learning.md) | [AWS (90)](documentation/AWS.md) |
 | [Installation](documentation/Installation.md) | [Build a Driver](documentation/Drivers.md) | [Mistakes (neg-feedback)](documentation/Mistakes.md) | [WWW (22)](documentation/WWW.md) |
 | [General Usage](documentation/General-PWN-Usage.md) | | [Reinforcement Learning](documentation/Reinforcement-Learning.md) | [SDR / Radio](documentation/SDR.md) |
 | [Configuration](documentation/Configuration.md) | | [Extrospection](documentation/Extrospection.md) | [Hardware](documentation/Hardware.md) |

data/documentation/Agent-Tool-Registry.md

@@ -6,15 +6,15 @@ toolsets; the JSON-Schema for each tool is what the model actually sees.
 
 ![Tool registry](diagrams/agent-tool-registry.svg)
 
-## Toolsets to tools  (13 toolsets · 85 tools)
+## Toolsets to tools  (13 toolsets · 87 tools)
 
 | Toolset | Tools | Backed by |
 |---|---|---|
 | `terminal` | `shell` | `Open3.capture3` on the host, after `PWN::AI::Agent::ToolGuard` |
 | `pwn` | `pwn_eval` | `TOPLEVEL_BINDING.eval` in the live REPL process, after `ToolGuard` |
 | `memory` | `memory_remember` · `memory_recall` · `memory_forget` · `memory_clear` · **`memory_lean`** | `PWN::Memory` → `~/.pwn/memory.json` |
-| `skills` | `skill_list` · `skill_view` · `skill_create` · `skill_add_reference` · `skill_delete` · `skill_migrate_legacy` | `~/.pwn/skills/<name>/SKILL.md` (**[agentskills.io](https://agentskills.io) spec**; legacy flat `*.md` auto-migrated) |
-| `sessions` | `sessions_list` · `sessions_view` · `sessions_current` · `sessions_delete` · `sessions_stats` · **`sessions_lean`** | `PWN::Sessions` → `~/.pwn/sessions/` |
+| `skills` | **`skills_recall`** · `skill_list` · `skill_view` · `skill_create` · `skill_add_reference` · `skill_delete` · `skill_migrate_legacy` | `~/.pwn/skills/<name>/SKILL.md` (**[agentskills.io](https://agentskills.io) spec**; legacy flat `*.md` auto-migrated) |
+| `sessions` | **`session_recall`** · `sessions_list` · `sessions_view` · `sessions_current` · `sessions_delete` · `sessions_stats` · **`sessions_lean`** | `PWN::Sessions` → `~/.pwn/sessions/` |
 | `learning` | `learning_note_outcome` · `learning_reflect` · `learning_distill_skill` · `learning_stats` · `learning_outcomes` · `learning_consolidate` · `learning_reset` · `learning_auto_introspect_toggle` · **`learning_gc_stores`** · **`learning_purge_noise`** · **`mistakes_list`** · **`mistakes_record`** · **`mistakes_resolve`** · **`mistakes_reset`** · **`mistakes_lean`** · **`reward_judge`** · **`reward_prm`** · **`reward_sentinel`** · **`reward_preferences`** · **`reward_export_dpo`** · **`reward_warm_sentinel`** · **`reward_scrub_preferences`** · **`reward_preference_balance`** · **`curriculum_practice`** · **`curriculum_train`** · **`curriculum_hindsight`** · **`curriculum_offline_judge`** · **`curriculum_preference_balance`** | `PWN::AI::Agent::Learning` + `Mistakes` + `Reward` + `Curriculum` → `~/.pwn/learning.jsonl` + `~/.pwn/mistakes.json` + `~/.pwn/preferences.jsonl` + `~/.pwn/curriculum/` + `~/.pwn/finetune/` |
 | `reward` | **`reward_generator_mix`** | `PWN::AI::Agent::Reward.generator_mix` → online preference source-mix controller (`preferences.jsonl`) |
 | `curriculum` | **`curriculum_practice_kpi`** | `PWN::AI::Agent::Curriculum.practice_kpi` → `~/.pwn/curriculum_kpi.jsonl` |
@@ -56,8 +56,9 @@ user request through as `relevance:`, `Registry.definitions` shrinks the
 pool to:
 
 ```text
-CORE_TOOLS  = shell · pwn_eval · memory_remember · memory_recall
-              mistakes_record · mistakes_resolve · learning_note_outcome
+CORE_TOOLS / DEFAULT_PREFERENCE (same list):
+memory_recall · session_recall · skills_recall · pwn_eval · shell
+mistakes_record · mistakes_resolve · learning_note_outcome · memory_remember
             + top-K keyword-ranked matches for THIS request
               (ties break on Metrics per-engine success_rate, then
                ai.agent.tool_preference)
@@ -68,7 +69,7 @@ PWN::AI::Agent::Registry.definitions(relevance: 'nmap sweep 10.0.0.0/8', top_k:
 PWN::AI::Agent::Registry.rank(query: 'run a shell command')   # inspect ranking
 PWN::AI::Agent::Registry.preference_order                     # Env / DEFAULT_PREFERENCE
 PWN::AI::Agent::Registry.toolsets                              # -> the 13 names above
-PWN::AI::Agent::Registry.all.count                             # -> 85
+PWN::AI::Agent::Registry.all.count                             # -> 87
 ```
 
 Frontier engines leave `tool_router` off (unless you set it) and receive the
@@ -80,7 +81,7 @@ When keyword fit and other rank scores tie, the registry prefers this
 default order:
 
 ```text
-memory_recall · pwn_eval · shell
+memory_recall · session_recall · skills_recall · pwn_eval · shell
 mistakes_record · mistakes_resolve · learning_note_outcome · memory_remember
 ```
 
@@ -88,9 +89,12 @@ Set `ai.agent.tool_preference` in `~/.pwn/pwn.yaml`, or pass `order:` /
 `preference:` into `Registry.definitions`, `.rank`, or `.apply_preference`.
 An explicit empty list turns preference off (no Env / default fallback).
 
+Learned facts and this session are injected (MEMORY / RECENT TURNS), not
+first tools. Preference then lists `pwn_eval` before `shell`. `sessions_view`
+is not a CORE tool. There is no separate ACT_PREFERENCE.
+
 Keyword fit stays the primary signal. Preference is a smaller bonus plus a
-stable sort after the router slims the pool, so `memory_recall` wins a
-tie against `shell` without hiding a better keyword match.
+stable sort after the router slims the pool.
 
 `Policy` uses the same list when it suggests a next action in the prompt.
 

data/documentation/CLI-Drivers.md

@@ -9,34 +9,33 @@ without a REPL or an LLM.
 ## Full list
 
 ```text
-pwn                                pwn_mail_agent
-pwn_android_war_dialer             pwn_msf_postgres_login
-pwn_autoinc_version                pwn_nessus_cloud_scan_crud
-pwn_aws_describe_resources         pwn_nessus_cloud_vulnscan
-pwn_bdba_groups                    pwn_nexpose
-pwn_bdba_scan                      pwn_nmap_discover_tcp_udp
-pwn_burp_suite_pro_active_rest_api_scan   pwn_openvas_vulnscan
-pwn_burp_suite_pro_active_scan     pwn_pastebin_sample_filter
-pwn_char_base64_encoding           pwn_phone
-pwn_char_dec_encoding              pwn_rdoc_to_jsonl
-pwn_char_hex_escaped_encoding      pwn_sast
-pwn_char_html_entity_encoding      pwn_serial_check_voicemail
-pwn_char_unicode_escaped_encoding  pwn_serial_msr206
-pwn_char_url_encoding              pwn_serial_qualcomm_commands
-pwn_crt_sh                         pwn_serial_son_micro_sm132_rfid
-pwn_defectdojo_engagement_create   pwn_setup
-pwn_defectdojo_importscan          pwn_shodan_graphql_introspection
-pwn_defectdojo_reimportscan        pwn_shodan_search
-pwn_diff_csv_files_w_column_exclude  pwn_simple_http_server
-pwn_domain_reversewhois            pwn_web_cache_deception
-pwn_fuzz_net_app_proto             pwn_www_checkip
-pwn_gqrx_scanner                   pwn_www_uri_buster
-pwn_jenkins_create_job             pwn_xss_dom_vectors
-pwn_jenkins_create_view            pwn_zaproxy_active_rest_api_scan
-pwn_jenkins_install_plugin         pwn_zaproxy_active_scan
-pwn_jenkins_thinBackup_aws_s3
-pwn_jenkins_update_plugins
-pwn_jenkins_useradd
+pwn                                pwn_jenkins_update_plugins
+pwn_ai_red_team                    pwn_jenkins_useradd
+pwn_android_war_dialer             pwn_mail_agent
+pwn_autoinc_version                pwn_msf_postgres_login
+pwn_aws_describe_resources         pwn_nessus_cloud_scan_crud
+pwn_bdba_groups                    pwn_nessus_cloud_vulnscan
+pwn_bdba_scan                      pwn_nexpose
+pwn_burp_suite_pro_active_rest_api_scan pwn_nmap_discover_tcp_udp
+pwn_burp_suite_pro_active_scan     pwn_openvas_vulnscan
+pwn_char_base64_encoding           pwn_pastebin_sample_filter
+pwn_char_dec_encoding              pwn_phone
+pwn_char_hex_escaped_encoding      pwn_rdoc_to_jsonl
+pwn_char_html_entity_encoding      pwn_sast
+pwn_char_unicode_escaped_encoding  pwn_serial_check_voicemail
+pwn_char_url_encoding              pwn_serial_msr206
+pwn_crt_sh                         pwn_serial_qualcomm_commands
+pwn_defectdojo_engagement_create   pwn_serial_son_micro_sm132_rfid
+pwn_defectdojo_importscan          pwn_setup
+pwn_defectdojo_reimportscan        pwn_shodan_graphql_introspection
+pwn_diff_csv_files_w_column_exclude pwn_shodan_search
+pwn_domain_reversewhois            pwn_simple_http_server
+pwn_fuzz_net_app_proto             pwn_web_cache_deception
+pwn_gqrx_scanner                   pwn_www_checkip
+pwn_jenkins_create_job             pwn_www_uri_buster
+pwn_jenkins_create_view            pwn_xss_dom_vectors
+pwn_jenkins_install_plugin         pwn_zaproxy_active_rest_api_scan
+pwn_jenkins_thinBackup_aws_s3      pwn_zaproxy_active_scan
 ```
 
 Run any with `--help` for its flags.

data/documentation/Configuration.md

@@ -118,7 +118,7 @@ ai:
 
   agent:
     native_tools: true             # Use provider-native tool_calls / function-calling. false → legacy text-parsed tool protocol.
-    max_iters: 75                  # Hard cap on tool-call rounds per user turn. Local engines tighten under budget pressure.
+    max_iters: 777                 # Hard cap on tool-call rounds per user turn. Scars do not lower it.
     task_summary: true             # Executive task briefs via TaskSummarizer (plan + about_to). false disables.
     task_summary_every: 5          # When task_summary_verbose: emit Progress every N completed tools.
     task_summary_interval_s: 8.0   # When verbose: also emit when this many seconds elapsed.
@@ -133,8 +133,10 @@ ai:
     shell_bash: false              # true -> run shell via bash -lc. Default is /bin/sh.
     plan_first: ~                  # Plan-then-act pre-pass. nil = auto (true when ai.active is ollama or openwebui).
     tool_router: ~                 # Dynamic tool-set slimming. nil = auto (true for ollama / openwebui).
-    tool_preference:               # Operator-tunable tool order. Rank bonus + Policy suggested-action list.
+    tool_preference:               # Same order as CORE_TOOLS: memory_recall, session_recall, skills_recall, pwn_eval, shell, mistakes_record, mistakes_resolve, learning_note_outcome, memory_remember. Current session is injected separately.
       - memory_recall
+      - session_recall
+      - skills_recall
       - pwn_eval
       - shell
       - mistakes_record
@@ -251,7 +253,7 @@ targets:                           # Optional - engagement-scope URLs/hosts. Mer
 
 ```ruby
 PWN::Env[:ai][:active]                          # => :grok
-PWN::Env.dig(:ai, :agent, :max_iters)           # => 75
+PWN::Env.dig(:ai, :agent, :max_iters)           # => 777
 PWN::EnvRedacted[:ai][:grok][:key]              # => ">>> REDACTED >>> ..."
 
 # Edit + re-encrypt + reload without leaving the REPL:
@@ -301,7 +303,7 @@ PWN::Config.refresh_env
 | Key path | Type | Default | Consumed by | Purpose |
 |---|---|---|---|---|
 | `ai.agent.native_tools` | Boolean | `true` | `PWN::Plugins::REPL` (`pwn-ai` cmd) | Use provider-native `tool_calls` / function-calling. `false` falls back to the legacy text-parsed tool protocol. |
-| `ai.agent.max_iters` | Integer | `75` | `PWN::AI::Agent::Loop.run`, `PWN::AI::Agent::Swarm` | Hard cap on tool-call rounds per user turn before a forced final answer. When recent turns keep hitting the ceiling, the effective cap is tightened (stricter on local engines than remote) so long multi-step goals keep a usable runway without thrashing. |
+| `ai.agent.max_iters` | Integer | `777` | `PWN::AI::Agent::Loop.run`, `PWN::AI::Agent::Swarm` | Hard cap on tool-call rounds per user turn. Budget-hot scars and overconfidence do not lower this request's runway. |
 | `ai.agent.task_summary` | Boolean | `true` | `PWN::AI::Agent::TaskSummarizer`, `Loop` | Master switch for executive task briefs (`emit_plan!` / `about_to`). |
 | `ai.agent.task_summary_every` | Integer | `5` | `TaskSummarizer.every_n` | Verbose progress cadence (tools). |
 | `ai.agent.task_summary_interval_s` | Float | `8.0` | `TaskSummarizer.interval_s` | Verbose progress cadence (seconds). |
@@ -315,7 +317,7 @@ PWN::Config.refresh_env
 | `ai.agent.shell_bash` | Boolean | `false` | `PWN::AI::Agent::ToolGuard.shell_bash?` | When true, `shell` runs via `bash -lc` so bash-only syntax is allowed. Default is POSIX `/bin/sh` and bashisms are rejected with a rewrite hint. |
 | `ai.agent.plan_first` | Boolean \| `nil` | `nil` (auto: `true` when `ai.active` is `ollama` or `openwebui`) | `PWN::AI::Agent::Loop.plan_first` | Plan-then-act pre-pass: the model must emit a numbered tool plan (as an assistant message) *before* it may dispatch anything. Cheap chain-of-thought scaffolding for local models. |
 | `ai.agent.tool_router` | Boolean \| `nil` | `nil` (auto: `true` for `ollama` / `openwebui`) | `PWN::AI::Agent::Registry.definitions` | Dynamic tool-set slimming: expose only `Registry::CORE_TOOLS` + the top-K keyword-relevant schemas for *this* request. Ties break on historical `Metrics` success rate, then `ai.agent.tool_preference`. |
-| `ai.agent.tool_preference` | Array\<String\> | `memory_recall`, `pwn_eval`, `shell`, `mistakes_record`, `mistakes_resolve`, `learning_note_outcome`, `memory_remember` | `PWN::AI::Agent::Registry.preference_order` / `.rank` / `.apply_preference`, `Policy` | Operator-tunable tool order. Keyword fit stays primary; act/recon kinds lead with `shell`/`pwn_eval`. Explicit empty list disables preference. |
+| `ai.agent.tool_preference` | Array\<String\> | `memory_recall`, `session_recall`, `skills_recall`, `pwn_eval`, `shell`, `mistakes_record`, `mistakes_resolve`, `learning_note_outcome`, `memory_remember` | `PWN::AI::Agent::Registry.preference_order` / `.rank` / `.apply_preference`, `Policy` | Same order as `CORE_TOOLS`. Current session is injected as RECENT TURNS. Explicit empty list disables preference. |
 | `ai.agent.defer_introspect` | Boolean | `true` | `PWN::AI::Agent::TurnFinalizer` | Run `Learning.auto_introspect` on a background thread after the user-visible reply. Specs and cron stay inline. |
 | `ai.agent.prompt_cache` | Boolean | `true` | `PWN::AI::Agent::PromptCache` | Engine-native prefix cache. Anthropic uses `cache_control`; OpenAI uses `prompt_cache_key`; Grok uses `x-grok-conv-id`; Gemini splits `systemInstruction`. Ollama and Open WebUI have no native prefix-cache field. |
 | `ai.agent.local_introspect` | Symbol | `failure_only` | `PWN::AI::Agent::Learning.auto_introspect` | End-of-turn introspect policy for local engines: `always` · `failure_only` · `every_n` (with `introspect_every_n`). |

data/documentation/Contributing.md

@@ -6,10 +6,10 @@
 lib/pwn/                # all namespaces
 lib/pwn/setup.rb        # PWN::Setup - doctor/provisioner data tables
 lib/pwn/migrate.rb      # PWN::Migrate - ~/.pwn state doctor / auto-migrator
-lib/pwn/plugins/        # 66 plugin modules
+lib/pwn/plugins/        # 67 plugin modules
 lib/pwn/ai/agent/       # agent core
 lib/pwn/ai/agent/tools/ # LLM tool registrations
-bin/                    # 53 pwn_* drivers + pwn (incl. pwn_setup)
+bin/                    # 54 executables: 53 pwn_* drivers + pwn (incl. pwn_setup)
 spec/                   # RSpec (incl. conventions_spec)
 documentation/          # this wiki + diagrams
 ```

data/documentation/Cron.md

@@ -36,15 +36,19 @@ does not remove existing per-job lines.
 
 ## Seeded self-improvement jobs (`PWN::Cron.install_defaults`)
 
-`pwn setup --migrate` (schema `v1`) seeds four jobs into every fresh
+`pwn setup --migrate` (schema `v1`) seeds five jobs into every fresh
 `~/.pwn/cron/jobs.yml` via `PWN::Cron.install_defaults`:
 
-| Name | Schedule | Ruby |
-|---|---|---|
-| `curriculum_practice_nightly` | `0 3 * * *` | `PWN::AI::Agent::Curriculum.practice(limit: 3)` |
-| `curriculum_offline_judge` | `30 3 * * *` | `PWN::AI::Agent::Curriculum.offline_judge(since_hours: 24, limit: 40)` |
-| `curriculum_train_weekly` | `0 4 * * 0` | `PWN::AI::Agent::Curriculum.train_and_gate(dry_run: true)` |
-| `learning_consolidate_nightly` | `0 5 * * *` | `PWN::AI::Agent::Learning.consolidate` |
+| Name | Schedule | Enabled | Ruby |
+|---|---|---|---|
+| `curriculum_practice_nightly` | `0 3 * * *` | **no** | `Curriculum.practice(limit: 3)` - opt-in; runs `Loop.run` with real tools |
+| `curriculum_offline_judge` | `30 3 * * *` | **no** | `Curriculum.offline_judge(...)` - opt-in; spends API tokens |
+| `curriculum_train_weekly` | `0 4 * * 0` | **no** | `Curriculum.train_and_gate(dry_run: true)` - opt-in; needs trainer+GPU to actually train |
+| `learning_consolidate_nightly` | `0 5 * * *` | **yes** | `Learning.consolidate` - memory GC |
+| `pwn_stores_lean_nightly` | `15 5 * * *` | **yes** | `Learning.gc_stores!` - lean memory, learning.jsonl, mistakes, policy, sessions |
+
+- **practice / judge / train** ship **disabled**. Practice self-plays via `Loop.run` (shell, browsers). Judge hits the live model. Train is a no-op without a LoRA trainer. Enable with `cron_enable` when you want that loop.
+- **consolidate + lean** stay on: they only touch `~/.pwn` files so the injected MEMORY / LEARNING / session tail stays high-signal.
 
 - **practice** - top unresolved `Mistakes` under `Reward.judge`; auto-`resolve` with ≥2 holdouts
 - **offline_judge** - backfill outcome/process labels + plan calibration from PLAN `p(success)=` so `:failure_only` local introspect does not starve the corpus; also runs `Reward.warm_sentinel` so the reward-sentinel window can fill on local hosts

data/documentation/Diagrams.md

@@ -23,7 +23,7 @@ groups) so lines never criss-cross.
 [source](diagrams/dot/persistence-filesystem.dot) · doc: [Persistence](Persistence.md)
 ![persistence-filesystem](diagrams/persistence-filesystem.svg)
 
-### Plugin Ecosystem (66 modules)
+### Plugin Ecosystem (67 modules)
 [source](diagrams/dot/plugin-ecosystem.dot) · doc: [Plugins](Plugins.md)
 ![plugin-ecosystem](diagrams/plugin-ecosystem.svg)
 
@@ -68,7 +68,7 @@ groups) so lines never criss-cross.
 [source](diagrams/dot/ai-integration-tool-calling.dot) · doc: [AI Integration](AI-Integration.md)
 ![ai-integration-tool-calling](diagrams/ai-integration-tool-calling.svg)
 
-### Agent Tool Registry (13 toolsets · 85 tools)
+### Agent Tool Registry (13 toolsets · 87 tools)
 [source](diagrams/dot/agent-tool-registry.dot) · doc: [Agent Tool Registry](Agent-Tool-Registry.md)
 ![agent-tool-registry](diagrams/agent-tool-registry.svg)
 

data/documentation/General-PWN-Usage.md

@@ -24,7 +24,7 @@ See [Installation](Installation.md) for every flag and the
 
 ```ruby
 PWN.help                            # top-level help
-PWN::Plugins.constants.sort         # list all 66 plugins
+PWN::Plugins.constants.sort         # list all 67 plugins
 PWN::Plugins::NmapIt.help           # per-plugin usage
 PWN::Setup.check                    # capability doctor from inside the REPL
 PWN::Migrate.status                 # ~/.pwn state-file compatibility rows

data/documentation/Home.md

@@ -2,8 +2,8 @@
 
 > **PWN** (/pōn/) - an open-source offensive-security automation framework and
 > continuous-security-integration platform written in Ruby.
-> 66 plugins · 48 SAST rules · 90 AWS wrappers · 22 WWW drivers · 53 CLI
-> drivers · 6 LLM engines · a self-improving multi-agent AI · one REPL.
+> 67 plugins · 48 SAST modules · 90 AWS wrappers · 22 WWW drivers · 54 CLI
+> executables · 6 LLM engines · a self-improving multi-agent AI · one REPL.
 
 **Repo root:** `/opt/pwn` · **This wiki:** `/opt/pwn/documentation/` ·
 **Rebuild diagrams:** `documentation/diagrams/build.sh`
@@ -28,7 +28,7 @@
 |---|---|
 | [The `pwn` REPL](pwn-REPL.md) | Pry shell with the whole `PWN::` namespace pre-loaded |
 | [`pwn-ai` Autonomous Agent](pwn-ai-Agent.md) | Natural-language TUI + `pwn --ai PROMPT` one-shot · **TaskSummarizer** briefs · iteration budget guard |
-| [CLI Drivers `bin/pwn_*`](CLI-Drivers.md) | 53 `pwn_*` + `pwn` headless executables for CI/CD |
+| [CLI Drivers `bin/pwn_*`](CLI-Drivers.md) | 54 headless executables (`pwn` + 53 `pwn_*`) for CI/CD |
 | [Drivers (build your own)](Drivers.md) | Turn a REPL session into a shipped binary |
 
 ## 🤖 AI Subsystem  (`PWN::AI`)
@@ -36,20 +36,21 @@
 | | |
 |---|---|
 | [AI / LLM Integration](AI-Integration.md) | OpenAI · Anthropic · Grok (OAuth) · Gemini · Ollama · Open WebUI |
-| [Agent Tool Registry](Agent-Tool-Registry.md) | 13 toolsets · **85** LLM-callable tools |
+| [Agent Tool Registry](Agent-Tool-Registry.md) | 13 toolsets · **87** LLM-callable tools |
 | [Memory · Skills · Learning](Skills-Memory-Learning.md) | Introspection - the self-improvement loop |
 | [Mistakes](Mistakes.md) | **Negative feedback** - fingerprint failures · do-NOT-repeat · `[REPEATING]`/`[REGRESSED]` · inline self-correction |
 | [Reinforcement Learning](Reinforcement-Learning.md) | **`Reward` + `Curriculum` + `Policy`** - outcome/process judges · preference ledger · self-play practice · live Q / REINFORCE (advisory) · export-ready LoRA gate |
 | [Extrospection](Extrospection.md) | World-awareness - snapshot · drift · intel · **watch** · **verify** · **rf_tune** · **osint** · serial · telecomm · packet · vision · voice · correlate |
 | [Swarm (Multi-Agent)](Swarm.md) | Personas · ask · debate · broadcast · shared bus |
 | [Sessions](Sessions.md) | Transcript persistence + reflection |
-| [Cron](Cron.md) | Scheduled autonomous jobs (nightly self-play + weekly weight-loop seeded by default) |
+| [Session Workflow](Session-Workflow.md) | Keywords: `continue` / last session / write-then-read / recon scope |
+| [Cron](Cron.md) | Scheduled jobs. Hygiene seeds on; curriculum practice/judge/train ship off |
 
 ## 🧩 Capability Namespaces  (`lib/pwn/*`)
 
 | | |
 |---|---|
-| [Plugins (66)](Plugins.md) | Every `PWN::Plugins::*` module by category |
+| [Plugins (67)](Plugins.md) | Every `PWN::Plugins::*` module by category |
 |   ↳ [BurpSuite](BurpSuite.md) ⭐ | Preferred web proxy / scanner |
 |   ↳ [TransparentBrowser](Transparent-Browser.md) | Headless / visible browser automation |
 |   ↳ [NmapIt](NmapIt.md) | Network discovery |

data/documentation/How-PWN-Works.md

@@ -20,16 +20,16 @@ hardware).
 | `pwn-ai` | `lib/pwn/ai/agent/loop.rb` | Agent TUI inside the REPL |
 | `pwn --ai PROMPT` | `bin/pwn` | Headless one-shot agent (CI-friendly) |
 | `pwn setup` | `lib/pwn/setup.rb` · `bin/pwn_setup` | Post-install doctor + capability provisioner + `--migrate` state doctor (also `pwn --setup[=PROFILE]`) |
-| `bin/pwn_*` | 53 files | Thin OptionParser wrappers over one plugin each |
-| `PWN::Cron` | `lib/pwn/cron.rb` | Scheduled jobs → any of the above (nightly self-play + weekly weight-loop seeded by default) |
+| `bin/pwn_*` + `pwn` | 54 files | Thin OptionParser wrappers plus the `pwn` REPL / one-shot agent |
+| `PWN::Cron` | `lib/pwn/cron.rb` | Scheduled jobs. Fresh install seeds hygiene on (`learning_consolidate_nightly`, `pwn_stores_lean_nightly`) and curriculum practice/judge/train off |
 
 ## L2 - AI agent core (`lib/pwn/ai/agent/`)
 
 | Module | Role |
 |---|---|
-| `Loop` | plan → **TaskSummarizer** briefs → dispatch tool_calls → observe → repeat until final answer; tightens runway when recent turns exhausted the budget |
-| **`TaskSummarizer`** | Executive UX: every request gets an English task compass (`emit_plan!` · `about_to` as `task k/n`) — no statement/question/goal type |
-| `Registry` | JSON-Schema function definitions grouped into 13 **toolsets** · **85 tools** · `CORE_TOOLS` default pool · kind-aware `tool_preference` |
+| `Loop` | plan → **TaskSummarizer** briefs → dispatch tool_calls → observe → repeat until final answer. Scars do not lower `max_iters` (default 777). Last-iter strips tools only when the original request is already satisfied |
+| **`TaskSummarizer`** | Executive UX: every request gets an English task compass (`emit_plan!` · `about_to` as `task k/n`) - no statement/question/goal type |
+| `Registry` | JSON-Schema function definitions grouped into 13 **toolsets** · **87 tools** · `CORE_TOOLS` = `DEFAULT_PREFERENCE` (`memory_recall` · `session_recall` · `skills_recall` · `pwn_eval` · `shell` · `mistakes_record` · `mistakes_resolve` · `learning_note_outcome` · `memory_remember`) |
 | `Dispatch` / `Result` | execute a tool, capture stdout/value/error/duration |
 | `PromptBuilder` | inject MEMORY / SKILLS / LEARNING / **KNOWN MISTAKES + FIXES** / METRICS / **POLICY** / EXTROSPECTION / RECENT TURNS |
 | `Metrics` · `Learning` · `Reflect` · **`Policy`** | **introspection** - how well am I doing? (Policy is live Q / REINFORCE, advisory rank only) |
@@ -45,7 +45,7 @@ call, and [Reinforcement Learning](Reinforcement-Learning.md) for how
 
 ## L3 - Capability namespaces (`lib/pwn/*`)
 
-`Plugins` (66) · `SAST` (48) · `WWW` (22) · `AWS` (90) · `SDR` · `Blockchain` ·
+`Plugins` (67) · `SAST` (48) · `WWW` (22) · `AWS` (90) · `SDR` · `Blockchain` ·
 `Bounty` · `Reports` · `FFI` · `Banner` · **`Setup`** · **`Migrate`**. Each is
 a plain module of `public_class_method def self.x(opts = {})` methods -
 callable the same way from the REPL, from `pwn_eval`, or from a driver.
@@ -75,9 +75,9 @@ Q / REINFORCE when the judge scores the turn, and **the prompt blocks**
 (MEMORY · SKILLS · LEARNING · KNOWN MISTAKES/FIXES · TOOL EFFECTIVENESS ·
 POLICY · EXTROSPECTION · RECENT TURNS) are re-injected into the next system
 prompt.
-Nightly cron practices the top unresolved Mistakes; weekly cron builds a
-LoRA and only promotes it if it beats the previous adapter on that same
-mistake set:
+Nightly hygiene cron trims `~/.pwn` stores. Curriculum practice, offline
+judge, and weekly LoRA train ship seeded but disabled; turn them on with
+`cron_enable` when you want that loop:
 
 ![Self-improvement loop](diagrams/pwn-ai-feedback-learning-loop.svg)
 

data/documentation/Installation.md

@@ -293,7 +293,7 @@ Vagrant, CI) picks it up automatically.
 ```ruby
 pwn[CURRENT_VERSION]:001 >>> PWN::Setup.check[:ok]          # => true
 pwn[CURRENT_VERSION]:002 >>> PWN::Migrate.needed?           # => false
-pwn[CURRENT_VERSION]:003 >>> PWN::Plugins.constants.count   # => 66
+pwn[CURRENT_VERSION]:003 >>> PWN::Plugins.constants.count   # => 67
 pwn[CURRENT_VERSION]:004 >>> PWN::SAST.constants.count      # => 48
 pwn[CURRENT_VERSION]:005 >>> pwn-ai                         # launches agent TUI
 ```

data/documentation/Persistence.md

@@ -24,7 +24,8 @@ Every byte PWN remembers between processes lives here.
 | `extrospection/packet/*.pcap` | `Extrospection` | pcap | `rm -rf` | bounded captures from `extro_packet(action: :capture)` |
 | `extrospection/voice/*` | `Extrospection` | wav / txt | `rm -rf` | TTS/STT artifacts from `extro_voice` |
 | `sessions/*.jsonl` | `PWN::Sessions` | JSON-per-line | `sessions_delete` | full transcript per pwn-ai run (with per-step `step_reward` from `Reward.prm`) |
-| `cron/jobs.yml` | `PWN::Cron` | YAML | `cron_remove` | scheduled prompt/ruby/script jobs (**seeded** with `curriculum_practice_nightly` + `curriculum_train_weekly`) |
+| `open_goal.json` | `PWN::AI::Agent::OpenGoal` | JSON | delete the file | unfinished host-work request so `continue` / `resume` picks it up |
+| `cron/jobs.yml` | `PWN::Cron` | YAML | `cron_remove` | scheduled jobs. Fresh install seeds hygiene (`learning_consolidate_nightly` + `pwn_stores_lean_nightly` **on**) and curriculum practice/judge/train **off** |
 | `cron/log/*.log` | `PWN::Cron` | text | rm | last_run output |
 | `agents.yml` | `PWN::AI::Agent::Swarm` | YAML | edit / `agent_spawn` | persona registry |
 | `swarm/<id>/bus.jsonl` | `Swarm` | JSON-per-line | rm -rf | append-only multi-agent chat |

data/documentation/Plugins.md

@@ -1,4 +1,4 @@
-# `PWN::Plugins` - All 66 Modules
+# `PWN::Plugins` - All 67 Modules
 
 Every plugin is a plain Ruby module of `public_class_method def self.x(opts = {})`
 methods with self-documenting `.help`. Source: `lib/pwn/plugins/*.rb`.
@@ -93,7 +93,7 @@ show-source PWN::Plugins::Fuzz.generate
 
 ### Utility
 `FileFu` · `ThreadPool` · `Log` · `PWNLogger` · `Char` · `XXD` · `DetectOS` ·
-`CreditCard` · `SSN` · `EIN` · `VIN` · `PS` · `MonkeyPatch` · `REPL`
+`CreditCard` · `SSN` · `EIN` · `VIN` · `PS` · `MonkeyPatch` · `REPL` · `TTYSpinner`
 
 ## Full alphabetical list
 
@@ -104,6 +104,6 @@ HackerOne Hunter IPInfo IRC Jenkins JiraDataCenter JSONPathify Log MailAgent
 Metasploit MonkeyPatch MSR206 NessusCloud NexposeVulnScan NmapIt OAuth2 OCR
 OpenAPI OpenVAS Packet PDFParse Pony PS PWNLogger RabbitMQ REPL ScannableCodes
 Serial Shodan SlackClient Sock Spider SSN ThreadPool Tor TransparentBrowser
-TwitterAPI URIScheme Vault VIN Voice Vsphere XXD Zaproxy`
+TTYSpinner TwitterAPI URIScheme Vault VIN Voice Vsphere XXD Zaproxy`
 
 [← Home](Home.md) · [Diagrams](Diagrams.md)