pwn 0.5.705 → 0.5.707

data/lib/pwn/ai/agent/loop.rb

@@ -3,6 +3,8 @@
 require 'json'
 require 'securerandom'
 require 'digest'
+require 'fileutils'
+require 'tmpdir'
 require 'pwn/ai/agent/mistakes'
 
 module PWN
@@ -324,7 +326,12 @@ module PWN
 
           top = Mistakes.top(limit: 24, unresolved_only: true)
           now = Time.now
-          budget = top.select { |mistake| budget_hit?(mistake: mistake) && !mistake[:parked] }
+          budget = top.select do |mistake|
+            next false if mistake[:parked]
+            next false if %w[agent_loop assistant_answer].include?(mistake[:tool].to_s)
+
+            budget_hit?(mistake: mistake)
+          end
           budget.each do |mistake|
             stamp = mistake_ts(mistake: mistake)
             next if stamp && (now - stamp) <= PARK_COOL_SECS
@@ -584,6 +591,10 @@ module PWN
           live = effects.reject { |fx| %i[recall store].include?(fx) }
           return true if live.empty?
           return true if duration_unsatisfied?(request: request)
+          return true if declared_contract_unsatisfied?(
+            request: request,
+            messages: opts[:messages]
+          )
           return true if need == :write && !write_verified?(effects: effects)
           return true if need == :browse && !effects.include?(:browse)
           return true if need == :any && !effects.intersect?(%i[write browse eval])
@@ -613,23 +624,166 @@ module PWN
         }.freeze
 
         private_class_method def self.duration_unsatisfied?(opts = {})
-          req = opts[:request].to_s
-          hours = nil
-          if (m = req.match(/\b(\d+)\s*(?:hours?|hrs?)\b/i))
-            hours = m[1].to_i
-          elsif (m = req.match(/\b(twenty-four|one|two|three|four|five|six|seven|eight|nine|ten|eleven|twelve|thirteen|fourteen|fifteen|sixteen|seventeen|eighteen|nineteen|twenty)\s*(?:hours?|hrs?)\b/i))
-            hours = HOUR_WORDS[m[1].downcase]
+          secs = declared_min_seconds(request: opts[:request])
+          if secs <= 0
+            req = opts[:request].to_s
+            hours = nil
+            if (m = req.match(/\b(\d+)\s*(?:hours?|hrs?)\b/i))
+              hours = m[1].to_i
+            elsif (m = req.match(/\b(twenty-four|one|two|three|four|five|six|seven|eight|nine|ten|eleven|twelve|thirteen|fourteen|fifteen|sixteen|seventeen|eighteen|nineteen|twenty)\s*(?:hours?|hrs?)\b/i))
+              hours = HOUR_WORDS[m[1].downcase]
+            end
+            secs = hours.to_i * 3600
           end
-          return false if hours.to_i <= 0
+          return false if secs <= 0
 
           t0 = Thread.current[:pwn_loop_t0]
           return false unless t0
 
-          (Time.now - t0) < (hours * 3600)
+          (Time.now - t0) < secs
+        rescue StandardError
+          false
+        end
+
+        EMPTY_CONTRACT = {
+          paths: [],
+          min_seconds: 0,
+          skills: [],
+          proofs: [],
+          hosts: [],
+          techniques: [],
+          issue_work: false
+        }.freeze
+
+        private_class_method def self.declared_min_seconds(opts = {})
+          declared_contract(request: opts[:request])[:min_seconds].to_i
+        end
+
+        private_class_method def self.declared_contract_unsatisfied?(opts = {})
+          contract = declared_contract(request: opts[:request])
+          files = Array(contract[:paths]) + Array(contract[:proofs])
+          return true if files.any? { |path| deliverable_missing?(path: path) }
+          return true if declared_skills_missing?(skills: contract[:skills])
+          return true if declared_hosts_missing?(hosts: contract[:hosts], messages: opts[:messages])
+          return true if declared_hosts_missing?(hosts: contract[:techniques], messages: opts[:messages])
+          return true if contract[:issue_work] && Array(contract[:proofs]).empty?
+
+          false
         rescue StandardError
           false
         end
 
+        private_class_method def self.declared_skills_missing?(opts = {})
+          names = Array(opts[:skills]).map(&:to_s).reject(&:empty?)
+          return false if names.empty?
+          return true unless defined?(PWN::Skills) && PWN::Skills.is_a?(Hash)
+
+          have = PWN::Skills.keys.map(&:to_s)
+          names.any? { |name| !have.include?(name) }
+        end
+
+        private_class_method def self.declared_hosts_missing?(opts = {})
+          hosts = Array(opts[:hosts]).map(&:to_s).reject(&:empty?)
+          return false if hosts.empty?
+
+          blob = Array(opts[:messages]).select { |msg| msg.is_a?(Hash) && msg[:role].to_s == 'tool' }
+                                       .map { |msg| msg[:content].to_s }
+                                       .join("\n")
+                                       .downcase
+          hosts.any? { |host| !blob.include?(host.to_s.downcase) }
+        end
+
+        private_class_method def self.declared_deliverables(opts = {})
+          Array(declared_contract(request: opts[:request])[:paths])
+        end
+
+        private_class_method def self.declared_contract(opts = {})
+          cached = Thread.current[:pwn_loop_deliverables]
+          return normalize_contract(raw: cached) if cached.is_a?(Array) || cached.is_a?(Hash)
+          return EMPTY_CONTRACT.dup unless Thread.current[:pwn_loop_active]
+
+          contract = infer_deliverables(request: opts[:request])
+          Thread.current[:pwn_loop_deliverables] = contract
+          contract
+        end
+
+        private_class_method def self.normalize_contract(opts = {})
+          raw = opts[:raw]
+          return EMPTY_CONTRACT.merge(paths: raw.map(&:to_s).select { |p| p.start_with?('/') }) if raw.is_a?(Array)
+          return EMPTY_CONTRACT.dup unless raw.is_a?(Hash)
+
+          hours = raw[:hours] || raw['hours']
+          secs = (raw[:min_seconds] || raw['min_seconds']).to_i
+          secs = hours.to_i * 3600 if secs <= 0 && hours.to_i.positive?
+          {
+            paths: abs_paths(rows: raw[:paths] || raw['paths']),
+            min_seconds: secs,
+            skills: Array(raw[:skills] || raw['skills']).map(&:to_s).reject(&:empty?).uniq,
+            proofs: abs_paths(rows: raw[:proofs] || raw['proofs']),
+            hosts: Array(raw[:hosts] || raw['hosts']).map(&:to_s).reject(&:empty?).uniq,
+            techniques: Array(raw[:techniques] || raw['techniques']).map(&:to_s).reject(&:empty?).uniq,
+            issue_work: raw[:issue_work] == true || raw['issue_work'] == true
+          }
+        end
+
+        private_class_method def self.abs_paths(opts = {})
+          Array(opts[:rows]).map(&:to_s).select { |path| path.start_with?('/') }.uniq
+        end
+
+        private_class_method def self.infer_deliverables(opts = {})
+          request = opts[:request].to_s
+          return EMPTY_CONTRACT.dup if request.strip.empty?
+
+          reply = call_engine(
+            messages: [
+              {
+                role: 'system',
+                content: 'Reply with JSON only. No markdown. No tools.'
+              },
+              {
+                role: 'user',
+                content: "Operator request:\n#{request}\n\n" \
+                         'When that request is complete, what must be true on this host? ' \
+                         'JSON only: {"paths":["/abs/file"],"min_seconds":0,"skills":["name"],' \
+                         '"proofs":["/abs/poc"],"hosts":["ip-or-hostname"],' \
+                         '"techniques":["T1059"],"issue_work":false}. ' \
+                         'issue_work=true when the ask needs findings, PoCs, or severity — then proofs must be non-empty absolute paths. ' \
+                         'Write reports with PWN::Reports::PDF.generate / HTML / Markdown / XML / CSV / JSON (path: or dir_path: + report_name:). ' \
+                         'Use [] or 0 when a field is not required. Do not invent work. Paths must be absolute.'
+              }
+            ],
+            tools: nil
+          )
+          text = reply.is_a?(Hash) ? (reply[:content] || reply['content']).to_s : reply.to_s
+          parse_contract(text: text)
+        rescue StandardError
+          EMPTY_CONTRACT.dup
+        end
+
+        private_class_method def self.parse_contract(opts = {})
+          text = opts[:text].to_s
+          json = nil
+          begin
+            json = JSON.parse(text, symbolize_names: true)
+          rescue JSON::ParserError
+            start = text.index('{')
+            stop = text.rindex('}')
+            return EMPTY_CONTRACT.dup unless start && stop && stop > start
+
+            json = JSON.parse(text[start..stop], symbolize_names: true)
+          end
+          normalize_contract(raw: json)
+        rescue StandardError
+          EMPTY_CONTRACT.dup
+        end
+
+        private_class_method def self.deliverable_missing?(opts = {})
+          path = opts[:path].to_s
+          path.empty? || !File.file?(path) || File.size(path) <= 0
+        rescue StandardError
+          true
+        end
+
         private_class_method def self.may_finalize?(opts = {})
           return false if incomplete_final?(text: opts[:text], last_iter: false)
           return false if request_unsatisfied?(
@@ -962,12 +1116,17 @@ module PWN
         end
 
         private_class_method def self.no_progress_result(opts = {})
+          checkpoint_result(opts)
+        end
+
+        private_class_method def self.checkpoint_result(opts = {})
           name = opts[:name].to_s
           sig = payload_sig(opts)
           JSON.generate(
-            success: false,
-            error: "no_progress: identical #{name} payload repeated (#{sig}). Change the command.",
-            result: { stdout: '', stderr: "no_progress: #{name}", exit: 2 }
+            success: true,
+            checkpoint: true,
+            error: "checkpoint: identical #{name} payload (#{sig}). World unchanged — vary args, target, or tool.",
+            result: { stdout: "checkpoint #{name} #{sig}", stderr: '', exit: 0 }
           )
         end
 
@@ -1029,15 +1188,10 @@ module PWN
           return nil unless plan_msg && !plan_msg[:content].to_s.strip.empty?
 
           plan = plan_msg[:content].to_s.strip
-          messages << { role: 'assistant', content: "PLAN:\n#{plan}" }
-          # S4 — adversarial plan review grounded in THIS host's telemetry.
-          # P17 — never fork red_team when budget fingerprints dominate: it is
-          # another mini agent loop and compounds iteration-budget exhaustion.
+          # TUI-only. Do not put PLAN: or red-team text on the model wire —
+          # original request stays the only user goal.
           rt = nil
-          if defined?(Curriculum) && !hot
-            rt = Curriculum.red_team_plan(request: opts[:request], plan: plan)
-            messages << { role: 'user', content: rt } if rt
-          end
+          rt = Curriculum.red_team_plan(request: opts[:request], plan: plan) if defined?(Curriculum) && !hot
           # P2 — unify TaskSummarizer plan object with surviving outline so the
           # task line and adversarial/plan_first plan are one thing. Index-only;
           # credit stays in Reward. Optional: only when ts_state is live.
@@ -1541,11 +1695,7 @@ module PWN
             collapsed << pair
           end
           kept = collapsed.last(keep_pairs).flatten
-          kept.each do |m|
-            next unless m[:role].to_s == 'tool' && m[:content].to_s.length > max_chars
-
-            m[:content] = "#{m[:content].to_s[0, max_chars]}…[compacted]"
-          end
+          spill_tool_history!(messages: kept, max_chars: max_chars)
           messages.replace(head + kept)
           repair_tool_history!(messages: messages)
           messages
@@ -1554,6 +1704,43 @@ module PWN
           opts[:messages]
         end
 
+        HISTORY_SPILL_DIR = File.join(Dir.tmpdir, 'pwn-ai-hist')
+        KEEP_FULL_TOOL_TAILS = 2
+
+        private_class_method def self.spill_tool_history!(opts = {})
+          messages = Array(opts[:messages])
+          max_chars = opts[:max_chars].to_i
+          max_chars = 2_000 if max_chars <= 0
+          tools = messages.select { |msg| msg[:role].to_s == 'tool' }
+          spill_n = [tools.length - KEEP_FULL_TOOL_TAILS, 0].max
+          idx = 0
+          messages.each do |msg|
+            next unless msg[:role].to_s == 'tool'
+
+            idx += 1
+            next if idx > spill_n
+
+            body = msg[:content].to_s
+            next if body.length <= max_chars
+            next if body.include?('[compacted path=')
+
+            msg[:content] = spill_tool_body(text: body)
+          end
+          messages
+        end
+
+        private_class_method def self.spill_tool_body(opts = {})
+          text = opts[:text].to_s
+          digest = Digest::SHA256.hexdigest(text)[0, 16]
+          dir = HISTORY_SPILL_DIR
+          FileUtils.mkdir_p(dir)
+          path = File.join(dir, "#{digest}.txt")
+          File.binwrite(path, text) unless File.file?(path)
+          "[compacted path=#{path} sha256=#{digest} bytes=#{text.bytesize}]"
+        rescue StandardError
+          "[compacted bytes=#{opts[:text].to_s.bytesize}]"
+        end
+
         private_class_method def self.repair_tool_history!(opts = {})
           messages = opts[:messages]
           return messages unless messages.is_a?(Array)
@@ -1913,9 +2100,7 @@ module PWN
               session_id: session_id,
               request: request,
               final: txt,
-              predicted: 0.85,
-              plan: [],
-              ts_state: nil
+              predicted: 0.85
             )
           end
           txt
@@ -1984,9 +2169,7 @@ module PWN
               session_id: session_id,
               request: request,
               final: txt,
-              predicted: 0.85,
-              plan: [],
-              ts_state: nil
+              predicted: 0.85
             )
           end
           txt
@@ -2010,9 +2193,7 @@ module PWN
               session_id: session_id,
               request: request,
               final: txt,
-              predicted: 0.95,
-              plan: ['Acknowledge greeting without tools or weather echo'],
-              ts_state: nil
+              predicted: 0.95
             )
           end
           txt
@@ -2094,9 +2275,7 @@ module PWN
               session_id: session_id,
               request: request,
               final: txt,
-              predicted: 0.9,
-              plan: ['Explain tool usage without live recon'],
-              ts_state: nil
+              predicted: 0.9
             )
           end
           txt
@@ -2306,9 +2485,7 @@ module PWN
                 session_id: session_id,
                 request: request,
                 final: txt,
-                predicted: 0.95,
-                plan: [plan_label || 'Recall prior turn from session transcript'],
-                ts_state: nil
+                predicted: 0.95
               )
             end
             return txt
@@ -2379,9 +2556,7 @@ module PWN
               session_id: session_id,
               request: request,
               final: txt,
-              predicted: 0.85,
-              plan: ['Recall prior turn (empty session fallback)'],
-              ts_state: nil
+              predicted: 0.85
             )
           end
           txt
@@ -2434,6 +2609,10 @@ module PWN
           Thread.current[:pwn_extinguished] = {}
           Thread.current[:pwn_same_payload] = Hash.new(0)
           Thread.current[:pwn_loop_t0] = Time.now unless nested
+          unless nested
+            Thread.current[:pwn_loop_active] = true
+            Thread.current[:pwn_loop_deliverables] = nil
+          end
           debug_progress(msg: "intent=#{intent} engine=#{engine}", debug: opts[:debug])
           expose_current_session(session_id: session_id)
           Mistakes.check_user_correction(request: request, session_id: session_id) if defined?(Mistakes)
@@ -2520,6 +2699,10 @@ module PWN
           # CORE_TOOLS is the default action space. Extra schemas are
           # opt-in via enabled_toolsets + core_only: false.
           core_only = opts.fetch(:core_only, true)
+          if nested && needs_host_work?(request: request)
+            opts[:enabled_toolsets] = nil
+            core_only = true
+          end
           tools = Registry.definitions(
             enabled: opts[:enabled_toolsets],
             relevance: request,
@@ -2672,12 +2855,20 @@ module PWN
             # commit that as the answer; drop the empty assistant turn,
             # inject a one-shot nudge, and keep iterating.
             if calls.empty? && text.strip.empty?
+              unsat = request_unsatisfied?(request: request, messages: messages)
               warn "[pwn-ai/loop] empty final from #{engine} on iter=#{i}; nudging" if local
+              empty_nudge = if unsat
+                              'Your previous reply was empty (no tool_calls and no content). ' \
+                                'The original request is not evidenced yet. Emit NATIVE tool_calls NOW. ' \
+                                'Do not write a final answer until that request is done or a tool returned failure evidence.'
+                            else
+                              'Your previous reply was empty (no tool_calls and no content). ' \
+                                'Either call a tool now, or write the final answer for the user as plain text. ' \
+                                'Do not reply with an empty message.'
+                            end
               messages << {
                 role: 'user',
-                content: 'Your previous reply was empty (no tool_calls and no content). ' \
-                         'Either call a tool now, or write the final answer for the user as plain text. ' \
-                         'Do not reply with an empty message.'
+                content: empty_nudge
               }
               turn_fails['empty_final'] += 1
               debug_progress(msg: "bounce empty_final snippet=#{debug_snippet(text: text)}")
@@ -2720,7 +2911,7 @@ module PWN
               debug_final_text!(text: text)
               final_chars = text.to_s.length
               append_session(session_id: session_id, role: 'assistant', content: text)
-              Learning.auto_introspect(session_id: session_id, request: request, final: text, predicted: predicted, plan: ts_state && ts_state[:plan], ts_state: ts_state) if defined?(Learning) && !nested && !no_tools && should_auto_introspect?(local: local, turn_fails: turn_fails, iter: i)
+              Learning.auto_introspect(session_id: session_id, request: request, final: text, predicted: predicted, ts_state: ts_state) if defined?(Learning) && !nested && !no_tools && should_auto_introspect?(local: local, turn_fails: turn_fails, iter: i)
               maybe_finish_policy(session_id: session_id, proxy_ok: true, ts_state: ts_state)
               task_summary_flush!(state: ts_state, on_tool: on_tool)
               OpenGoal.clear! if defined?(OpenGoal) && !nested
@@ -2754,11 +2945,7 @@ module PWN
               else
                 raw = Dispatch.call(tool_call: tc)
                 same_n = note_same_payload!(name: name, args: args)
-                if same_n >= 3
-                  Thread.current[:pwn_extinguished] ||= {}
-                  Thread.current[:pwn_extinguished][sig] = true
-                  raw = no_progress_result(name: name, args: args)
-                end
+                raw = checkpoint_result(name: name, args: args) if same_n >= 3
               end
               tools_called += 1
               tele    = record_metrics(name: name, started: started, raw: raw, args: args, session_id: session_id, engine: engine, ts_state: ts_state)
@@ -2830,6 +3017,10 @@ module PWN
           end
           raise
         ensure
+          unless nested
+            Thread.current[:pwn_loop_active] = nil
+            Thread.current[:pwn_loop_deliverables] = nil
+          end
           Thread.current[:pwn_loop_no_tools] = nil
           finish_debug_request!(
             iter: i,

data/lib/pwn/ai/agent/policy.rb

@@ -752,16 +752,34 @@ module PWN
           return 0.0 unless ep.is_a?(Hash)
 
           bonus = 0.0
-          new_idx = ts_idx(ts_state: opts[:ts_state])
-          new_open = ts_open?(ts_state: opts[:ts_state])
-          bonus += STEP_TASK if !ep[:plan_idx].nil? && new_idx > ep[:plan_idx].to_i
-          bonus += STEP_CLOSED if ep[:plan_open] && new_open == false
-          bonus += STEP_GRIND if new_open == false && opts[:ok] && opts[:action].to_s != 'final'
+          met = contract_fields_met(request: ep[:request].to_s)
+          prev = ep[:contract_met].to_i
+          if met > prev
+            bonus += STEP_TASK
+            ep[:contract_met] = met
+          end
+          bonus += STEP_GRIND if met.positive? && opts[:ok] && opts[:action].to_s != 'final'
           bonus
         rescue StandardError
           0.0
         end
 
+        private_class_method def self.contract_fields_met(opts = {})
+          raw = Thread.current[:pwn_loop_deliverables]
+          return 0 unless raw.is_a?(Hash) || opts.key?(:request)
+          return 0 unless raw.is_a?(Hash)
+
+          n = 0
+          n += 1 if raw[:min_seconds].to_i.positive? || raw['min_seconds'].to_i.positive?
+          files = Array(raw[:paths] || raw['paths']) + Array(raw[:proofs] || raw['proofs'])
+          n += files.count { |path| File.file?(path.to_s) && File.size(path.to_s).positive? }
+          n += Array(raw[:hosts] || raw['hosts']).length
+          n += Array(raw[:techniques] || raw['techniques']).length
+          n
+        rescue StandardError
+          0
+        end
+
         private_class_method def self.terminal_reward(opts = {})
           return ((2.0 * opts[:score].to_f) - 1.0).clamp(-1.0, 1.0) unless opts[:score].nil?
 

data/lib/pwn/ai/agent/reward.rb

@@ -81,15 +81,16 @@ module PWN
 
         JUDGE_SYSTEM = <<~SYS
           You are the pwn-ai Outcome Reward Model. Given a USER REQUEST, the
-          agent's FINAL ANSWER, a compressed TOOL TRACE, and optional PLAN
-          COVERAGE, emit ONE line of strict JSON:
+          agent's FINAL ANSWER, and a compressed TOOL TRACE, emit ONE line of
+          strict JSON:
             {"score": <0.0-1.0>, "verdict": "solved|partial|wrong|refused",
              "rationale": "<≤140 chars>", "key_step": <int|-1>}
-          Grade the HUMAN RESULT, not handler success:
+          Grade the HUMAN RESULT against the USER REQUEST only — never a TUI
+          plan, stub outline, or competing compass:
             1.0 = final is usable and complete (every asked point answered with
                   evidence from the trace or a checkable claim).
             0.7 = mostly complete, one missing detail, still usable.
-            0.5 = correct direction but incomplete / truncated / plan open.
+            0.5 = correct direction but incomplete / truncated.
             0.2 = tools ran but the final does not answer the ask.
             0.0 = hallucinated, off-goal, empty, polite non-answer, or refused.
           Ignore {"success":true} as evidence of done. Prefer last tool steps.
@@ -124,8 +125,8 @@ module PWN
           trace   = load_trace(session_id: opts[:session_id]) if trace.empty? && opts[:session_id]
           commit  = opts.key?(:commit) ? opts[:commit] : true
 
-          v = llm_judge(request: request, final: final, trace: trace, plan: opts[:plan])
-          v ||= heuristic_judge(request: request, final: final, trace: trace, plan: opts[:plan])
+          v = llm_judge(request: request, final: final, trace: trace)
+          v ||= heuristic_judge(request: request, final: final, trace: trace)
           # Cheap ORM is the intended source. Heuristic overlap is fallback
           # only — callers (sentinel / Learning.stats / Metrics.effective_rate)
           # weight :llm_orm samples above :heuristic so the haircut tracks
@@ -1075,17 +1076,7 @@ module PWN
           # human got a usable result. Keep the first step for context.
           shown = compact_trace_tail(steps: steps, keep: CHEAP_ORM_TRACE_N)
           trace = shown.each_with_index.map { |s, i| "#{i + 1}. #{s.to_s.gsub(/\s+/, ' ')[0, 220]}" }.join("\n")
-          plan = ''
-          if respond_to?(:plan_coverage)
-            cov = plan_coverage(
-              plan: opts[:plan],
-              final: opts[:final],
-              request: opts[:request],
-              trace: steps
-            )
-            plan = "\nPLAN COVERAGE: #{cov[:covered]}/#{cov[:total]} (#{cov[:tag]}) missing=#{Array(cov[:missing]).first(3).join(' | ')}" if cov && cov[:total].to_i.positive?
-          end
-          req = "USER REQUEST:\n#{opts[:request].to_s[0, 700]}\n\nFINAL ANSWER:\n#{opts[:final].to_s[0, 1_600]}\n\nTOOL TRACE (#{steps.length} steps, showing #{shown.length}):\n#{trace}#{plan}"
+          req = "USER REQUEST:\n#{opts[:request].to_s[0, 700]}\n\nFINAL ANSWER:\n#{opts[:final].to_s[0, 1_600]}\n\nTOOL TRACE (#{steps.length} steps, showing #{shown.length}):\n#{trace}"
           resp = cheap_orm_chat(request: req, system_role_content: JUDGE_SYSTEM)
           parsed = parse_llm_judge(resp: resp)
           return nil if parsed.nil?
@@ -1093,7 +1084,7 @@ module PWN
           # Soft-blend a stronger-than-overlap evidence prior so a noisy
           # cheap ORM cannot peg 0.0/1.0 against an obviously incomplete
           # or obviously complete final.
-          ev = evidence_prior(request: opts[:request], final: opts[:final], trace: steps, plan: opts[:plan])
+          ev = evidence_prior(request: opts[:request], final: opts[:final], trace: steps)
           if ev && ev[:confidence].to_f >= 0.5
             raw = parsed[:score].to_f
             # Sanity bounds only: do not always blend (would fight a good ORM).
@@ -1317,11 +1308,10 @@ module PWN
           polite = final.match?(/\A\s*(sure|happy to help|of course|i can help|how can i|let me know)\b/i) && final.length < 120
           return { score: 0.1, verdict: :partial, rationale: 'polite non-answer', key_step: -1, source: :heuristic } if polite && trace.empty?
 
-          ev = evidence_prior(request: request, final: final, trace: trace, plan: opts[:plan])
+          ev = evidence_prior(request: request, final: final, trace: trace)
           score = ev ? ev[:score].to_f : 0.35
           # Overlap is a small on-topic gate, not the score. The evidence
-          # prior (completeness, plan cover, concrete claims, trace echo)
-          # is the fallback ORM.
+          # prior (completeness, concrete claims, trace echo) is the fallback ORM.
           req_toks = request.downcase.scan(/[a-z0-9_]{3,}/).uniq
           fin_toks = final.downcase.scan(/[a-z0-9_]{3,}/).uniq
           overlap  = req_toks.empty? ? 1.0 : (req_toks & fin_toks).length.to_f / req_toks.length
@@ -1403,8 +1393,6 @@ module PWN
             score += 0.08 if ov >= 0.25
             score -= 0.12 if ov < 0.08 && req_toks.length >= 4
           end
-          cov = plan_coverage(plan: opts[:plan], final: final, request: request, trace: trace) if respond_to?(:plan_coverage)
-          score = ((score * 0.55) + (cov[:score].to_f * 0.45)) if cov && cov[:total].to_i.positive?
           { score: score.round(3).clamp(0.0, 0.9), confidence: 0.62 }
         rescue StandardError
           nil

data/lib/pwn/ai/agent/turn_finalizer.rb

@@ -86,7 +86,6 @@ module PWN
             request: opts[:request],
             final: opts[:final],
             predicted: opts[:predicted],
-            plan: opts[:plan],
             ts_state: opts[:ts_state],
             inline: true
           }

data/lib/pwn/reports/ai_red_team.rb

@@ -26,7 +26,7 @@ module PWN
         report_name = opts[:report_name] ||= File.basename(Dir.pwd)
         File.write(
           "#{dir_path}/#{report_name}.json",
-          JSON.pretty_generate(results_hash)
+          ::JSON.pretty_generate(results_hash)
         )
 
         column_names = [

data/lib/pwn/reports/csv.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require 'csv'
+
+module PWN
+  module Reports
+    # Generic CSV report writer for pentest / findings payloads.
+    module CSV
+      public_class_method def self.generate(opts = {})
+        out = PWN::Reports.resolve_path(opts.merge(ext: 'csv'))
+        payload = PWN::Reports.report_payload(opts)
+        rows = payload[:findings]
+        headers = %w[id title severity cvss epss description poc impact recommendation]
+        extra = rows.flat_map(&:keys).uniq - headers
+        cols = (headers + extra).uniq
+        ::CSV.open(out, 'w') do |csv|
+          csv << cols
+          if rows.empty?
+            csv << cols.map { |col| col == 'title' ? payload[:title] : nil }
+          else
+            rows.each do |row|
+              csv << cols.map { |col| row[col] }
+            end
+          end
+        end
+        out
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:\n  #{self}.generate(\n    path: '/tmp/report.csv',\n    results_hash: {}\n  )\n\n  #{self}.authors\n"
+      end
+    end
+  end
+end

data/lib/pwn/reports/fuzz.rb

@@ -27,7 +27,7 @@ module PWN
         # JSON object Completion
         File.open("#{dir_path}/#{report_name}.json", "w:#{char_encoding}") do |f|
           f.print(
-            JSON.pretty_generate(results_hash).force_encoding(char_encoding)
+            ::JSON.pretty_generate(results_hash).force_encoding(char_encoding)
           )
         end