pwn 0.5.780 → 0.5.781

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3207a135c108d0af20cc351965b217a3235abb0eaf67a31d244e3779ed6b72e5
-  data.tar.gz: 750df1371f8eb0fbab32b66e88b7568dbac4a49de7dc4020fc018a9957053acc
+  metadata.gz: be1437ab0b3260ca673ef36aa2c5d062008637493f6c0a02c0863e514fc3b199
+  data.tar.gz: 2c10c59ab8501a88b0e788034d8319e04a58d4322c2ed345f6cb88bf11e9e452
 SHA512:
-  metadata.gz: b10627e1329fa50ac482a49b1013ab455f52eac1a943d92ef7f9144bb93625e742935e0ad2caa1294f3d10a3c46d758b0de50695463e138af76ed7f61871438b
-  data.tar.gz: 3f55e834e447b8d51b8a28bd0c71d97498e577d49d7dadfea2a5ceda5e5bfa3876225d27f0c238b02dce690ea82d48612d29fd8a45130cea8213fc4a5650ce0a
+  metadata.gz: 51827bef402328c9bfe195fac4a7542733b485651e4cfd6eb87203abf5ee0a7c83c1dd5837da133d1fdcb21e1582cc9f6867087f427293b6a4719de2efe0a857
+  data.tar.gz: a19aaf87f51bfaa1101918cd9c1526791d6953249ba992a51ebfe86db5a4eec8da79e348dc29263161f17d9754f108f53b5044d53c98a92719900668883a886f

data/Gemfile

@@ -50,7 +50,7 @@ gem 'libusb', '0.8.0'
 gem 'luhn', '3.0.0'
 gem 'mail', '2.9.1'
 gem 'mcp', '1.8.1'
-gem 'meshtastic', '0.0.188'
+gem 'meshtastic', '0.0.189'
 gem 'metasm', '1.0.6'
 gem 'mongo', '2.26.0'
 gem 'msfrpc-client', '1.1.2'
@@ -81,7 +81,7 @@ gem 'rmagick', '7.2.0'
 gem 'rqrcode', '3.2.0'
 gem 'rspec', '3.13.2'
 gem 'rtesseract', '3.1.4'
-gem 'rubocop', '1.92.0'
+gem 'rubocop', '1.92.1'
 gem 'rubocop-rake', '0.7.1'
 gem 'rubocop-rspec', '3.10.2'
 gem 'ruby-audio', '1.6.1'

data/documentation/AI-Integration.md

@@ -18,9 +18,9 @@ agent code never cares which model is behind it.
 | `openwebui` | `PWN::AI::OpenWebUI` | `key:` (JWT / API token) + `base_uri:` | Open WebUI gateway - OpenAI-compatible `/api/v1/chat/completions` plus proxied Ollama `/ollama/api/*` (including embed) |
 
 > PWN is **model-agnostic**. `ai.<engine>.model` is passed straight through to
-> the provider - the codebase and docs deliberately never name a specific
-> model id so you can point each engine at whatever the vendor currently
-> ships (or whatever `ollama list` shows locally).
+choose a provider-supported model ID (or a tag from `ollama list`).
+Provider-specific reasoning/endpoint compatibility logic still exists; changing
+`base_uri` alone does not implement Azure or Bedrock authentication/protocols.
 
 ## Selecting an engine
 
@@ -79,7 +79,7 @@ The harness adapts to the *class* of engine, not the model name:
 |---|---|---|
 | **PromptBuilder.budget** | full MEMORY / METRICS / MISTAKES / LEARNING / EXTRO blocks | tightened via `ai.ollama.prompt_budget` (extro off by default) |
 | **MEMORY ranking** | relevance-ranked when a local Ollama `embed_model` is reachable, else newest-first | relevance-ranked via `PWN::MemoryIndex` (`~/.pwn/memory.idx`) |
-| **Tool schemas shipped** | all toolsets | `CORE_TOOLS` + top-K keyword matches when `ai.agent.tool_router` is on (default on). Ties also honor `tool_preference`. |
+| **Tool schemas shipped** | Loop normally requests core-only schemas; explicit Registry callers may request more | `CORE_TOOLS` + top-K keyword matches when `ai.agent.tool_router` is on (default on). Ties also honor `tool_preference`. |
 | **Pre-pass** | none | `plan_first` numbered tool plan before first dispatch |
 | **Intent route** | always | `request_intent` only (greeting / howto / recall cheap paths). There is no request type. Every other turn gets a TaskSummarizer compass and CORE_TOOLS. |
 | **Few-shot** | none | `Learning.exemplars_for(request)` splices a prior successful trace |

data/documentation/AWS.md

@@ -8,21 +8,22 @@ with the PWN `opts = {}` convention so they compose in the REPL and in
 
 ## Credentials
 
-Standard AWS SDK chain: `~/.aws/credentials` profile, env vars
-(`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`), or
-instance profile. Optionally pin in `~/.pwn/pwn.yaml` under `aws:`.
+Service wrappers expose `connect`/`disconnect`, not every AWS SDK operation
+as a PWN module method. Supply `region`, `access_key_id`, `secret_access_key`
+and optional `sts_session_token` to `connect`; retrieve credentials through
+your approved secret source without printing them. `STS.get_temp_credentials`
+is the separate assume-role helper. Inspect each module's `.help` first.
 
 ## Quick enumeration
 
 ```ruby
-PWN::AWS::STS.get_caller_identity
-PWN::AWS::IAM.list_users
-PWN::AWS::EC2.describe_instances(region: 'us-east-1')
-PWN::AWS::S3.list_buckets
-PWN::AWS::Lambda.list_functions
+# credentials is an operator-supplied Hash; never log its values.
+ec2 = PWN::AWS::EC2.connect(credentials.merge(region: 'us-east-1'))
+instances = ec2.describe_instances
+PWN::AWS::EC2.disconnect(ec2_obj: ec2)
 ```
 
-CLI: `pwn_aws_describe_resources -r us-east-1 -o out/`
+CLI: `pwn_aws_describe_resources -r us-east-1 -c /path/to/private-aws.yaml`
 
 ## Service groups
 

data/documentation/Agent-Tool-Registry.md

@@ -11,18 +11,18 @@ toolsets; the JSON-Schema for each tool is what the model actually sees.
 | Toolset | Tools | Backed by |
 |---|---|---|
 | `http` | `http_proxy_start` · `http_proxy_stop` · `http_proxy_entries` · `http_proxy_rules` · `http_replay` | `PWN::Plugins::MitmProxy`: native HTTP HAR capture/replay; opaque CONNECT tunnels |
-| `terminal` | `shell` · `job_run` · `job_status` · `job_tail` · `job_result` · `job_kill` | Foreground host commands plus `PWN::Plugins::Jobs` durable supervisors |
-| `pwn` | `pwn_eval` · `sbom_scan` · `r2_functions` · `r2_disasm` · `gdb_run_to_crash` · `nmap_scan` · `nuclei_scan` · `browser_goto` · `loot_query` | `TOPLEVEL_BINDING.eval` in the live REPL process, after `ToolGuard`; SBOM engines via `PWN::Plugins::SBOM` store CVE leads as recon observations, not findings; r2pipe JSON via `PWN::Plugins::Radare2`; gdb MI3 crash reports via `PWN::Plugins::GDBMI`; nmap XML ingest/diff via `PWN::Plugins::NmapIt`, which skips a known port unless `refresh: true`; nuclei/httpx JSONL via `PWN::Plugins::Nuclei` writes a recon observation (a template match is not a finding) and accepts a `Recon.handoff` record; TransparentBrowser navigation captures screenshot/DOM/HAR via `browser_goto`; engagement loot via `PWN::Plugins::Vault` |
+| `terminal` | `pty_expect` · `job_run` · `job_status` · `job_result` · `job_tail` · `job_kill` · `pty_open` · `pty_send` · `pty_read` · `pty_close` · `pty_session` · `shell` | Foreground host commands plus `PWN::Plugins::Jobs` durable supervisors |
+| `pwn` | `binary_triage` · `browser_goto` · `capabilities` · `debug_session` · `gdb_run_to_crash` · `binary_diff` · `crash_triage` · `emulate` · `detonate` · `decompile` · `exploitdev` · `finding_record` · `finding_report` · `chain_score` · `fuzz_campaign` · `intel_lookup` · `loot_query` · `nmap_scan` · `nuclei_scan` · `r2_functions` · `r2_disasm` · `recon_run` · `pwn_eval` · `sandbox_run` · `sandbox_fuzz` · `sbom_scan` · `swarm_map` | `TOPLEVEL_BINDING.eval` in the live REPL process, after `ToolGuard`; SBOM engines via `PWN::Plugins::SBOM` store CVE leads as recon observations, not findings; r2pipe JSON via `PWN::Plugins::Radare2`; gdb MI3 crash reports via `PWN::Plugins::GDBMI`; nmap XML ingest/diff via `PWN::Plugins::NmapIt`, which skips a known port unless `refresh: true`; nuclei/httpx JSONL via `PWN::Plugins::Nuclei` writes a recon observation (a template match is not a finding) and accepts a `Recon.handoff` record; TransparentBrowser navigation captures screenshot/DOM/HAR via `browser_goto`; engagement loot via `PWN::Plugins::Vault` |
 | `mcp` | `mcp` | `PWN::AI::MCP` session broker → any `PWN::AI::MCP::*` stdio client |
-| `memory` | `memory_remember` · `memory_recall` · `memory_forget` · `memory_clear` · **`memory_lean`** | `PWN::Memory` → `~/.pwn/memory.json` |
-| `skills` | `skills_consolidate` · **`skills_recall`** · `skill_list` · `skill_view` · `skill_create` · `skill_add_reference` · `skill_delete` · `skill_migrate_legacy` | `~/.pwn/skills/<name>/SKILL.md` (**[agentskills.io](https://agentskills.io) spec**; legacy flat `*.md` auto-migrated) |
-| `sessions` | **`session_recall`** · `sessions_list` · `sessions_view` · `sessions_current` · `sessions_delete` · `sessions_stats` · **`sessions_lean`** · `artifact_read` · `artifact_grep` · `artifacts_list` · `artifacts_get` · `artifact_put` · `artifact_get` | `PWN::Sessions` → `~/.pwn/sessions/`; `PWN::Plugins::ArtifactRegistry` → `~/.pwn/artifacts/` |
-| `learning` | `learning_note_outcome` · `learning_reflect` · `learning_distill_skill` · `learning_stats` · `learning_outcomes` · `learning_consolidate` · `learning_reset` · `learning_auto_introspect_toggle` · **`learning_gc_stores`** · **`learning_purge_noise`** · **`mistakes_list`** · **`mistakes_record`** · **`mistakes_resolve`** · **`mistakes_reset`** · **`mistakes_lean`** · **`reward_judge`** · **`reward_prm`** · **`reward_sentinel`** · **`reward_preferences`** · **`reward_export_dpo`** · **`reward_warm_sentinel`** · **`reward_scrub_preferences`** · **`reward_preference_balance`** · **`curriculum_practice`** · **`curriculum_train`** · **`curriculum_hindsight`** · **`curriculum_offline_judge`** · **`curriculum_preference_balance`** | `PWN::AI::Agent::Learning` + `Mistakes` + `Reward` + `Curriculum` → `~/.pwn/learning.jsonl` + `~/.pwn/mistakes.json` + `~/.pwn/preferences.jsonl` + `~/.pwn/curriculum/` + `~/.pwn/finetune/` |
-| `reward` | **`reward_generator_mix`** | `PWN::AI::Agent::Reward.generator_mix` → online preference source-mix controller (`preferences.jsonl`) |
-| `curriculum` | **`curriculum_practice_kpi`** | `PWN::AI::Agent::Curriculum.practice_kpi` → `~/.pwn/curriculum_kpi.jsonl` |
-| `metrics` | `metrics_summary` · `metrics_reset` | `PWN::AI::Agent::Metrics` → `~/.pwn/metrics.json`. ESR is `verified_exploit_tools / vulnerable_tools`. ASR is `successful_attacks / total_attack_attempts`. |
-| `policy` | **`policy_stats`** · **`policy_evaluate`** · **`policy_recommend`** | `PWN::AI::Agent::Policy` → `~/.pwn/policy.json` + `~/.pwn/policy_traj.jsonl` |
-| `extrospection` | `extro_snapshot` · `extro_drift` · `extro_observe` · `extro_observations` · `extro_intel` · **`extro_watch`** · **`extro_verify`** · **`extro_rf_tune`** · **`extro_osint`** · **`extro_serial`** · **`extro_telecomm`** · **`extro_packet`** · **`extro_vision`** · **`extro_voice`** · `extro_correlate` · `extro_stats` · `extro_reset` · `extro_auto_toggle` | `PWN::AI::Agent::Extrospection` (+ Serial/Packet/OCR/Voice/BareSIP/TransparentBrowser/GQRX) → `~/.pwn/extrospection.json` |
+| `memory` | `memory_remember` · `memory_recall` · `memory_forget` · `memory_clear` · `memory_lean` | `PWN::Memory` → `~/.pwn/memory.json` |
+| `skills` | `skills_recall` · `skills_update` · `skill_list` · `skill_view` · `skill_create` · `skills_create` · `skill_add_reference` · `skill_delete` · `skill_migrate_legacy` · `skills_consolidate` | `~/.pwn/skills/<name>/SKILL.md` (**[agentskills.io](https://agentskills.io) spec**; legacy flat `*.md` auto-migrated) |
+| `sessions` | `artifacts_list` · `artifacts_get` · `artifact_read` · `artifact_grep` · `artifact_put` · `artifact_get` · `context_attach` · `capability_request` · `budget_status` · `engagement_open` · `engagement_close` · `engagement_status` · `session_export` · `session_recall` · `sessions_list` · `sessions_view` · `sessions_delete` · `sessions_stats` · `sessions_current` · `sessions_lean` · `verify` | `PWN::Sessions` → `~/.pwn/sessions/`; `PWN::Plugins::ArtifactRegistry` → `~/.pwn/artifacts/` |
+| `learning` | `curriculum_practice` · `curriculum_train` · `curriculum_hindsight` · `learning_purge_noise` · `curriculum_offline_judge` · `curriculum_preference_balance` · `learning_note_outcome` · `learning_reflect` · `learning_distill_skill` · `learning_stats` · `learning_outcomes` · `learning_consolidate` · `learning_reset` · `learning_auto_introspect_toggle` · `learning_gc_stores` · `mistakes_list` · `mistakes_record` · `mistakes_resolve` · `mistakes_lean` · `mistakes_reset` · `reward_judge` · `reward_prm` · `reward_sentinel` · `reward_preferences` · `reward_export_dpo` · `reward_warm_sentinel` · `reward_scrub_preferences` · `reward_preference_balance` | `PWN::AI::Agent::Learning` + `Mistakes` + `Reward` + `Curriculum` → `~/.pwn/learning.jsonl` + `~/.pwn/mistakes.json` + `~/.pwn/preferences.jsonl` + `~/.pwn/curriculum/` + `~/.pwn/finetune/` |
+| `reward` | `reward_generator_mix` | `PWN::AI::Agent::Reward.generator_mix` → online preference source-mix controller (`preferences.jsonl`) |
+| `curriculum` | `curriculum_practice_kpi` | `PWN::AI::Agent::Curriculum.practice_kpi` → `~/.pwn/curriculum_kpi.jsonl` |
+| `metrics` | `metrics_summary` · `metrics_reset` · `ai_usage` | `PWN::AI::Agent::Metrics` → `~/.pwn/metrics.json`. ESR is `verified_exploit_tools / vulnerable_tools`. ASR is `successful_attacks / total_attack_attempts`. |
+| `policy` | `policy_stats` · `policy_evaluate` · `policy_recommend` | `PWN::AI::Agent::Policy` → `~/.pwn/policy.json` + `~/.pwn/policy_traj.jsonl` |
+| `extrospection` | `extro_snapshot` · `extro_drift` · `extro_observe` · `extro_observations` · `extro_intel` · `extro_correlate` · `extro_stats` · `extro_reset` · `extro_auto_toggle` · `extro_verify` · `extro_watch` · `extro_rf_tune` · `extro_osint` · `extro_serial` · `extro_telecomm` · `extro_packet` · `extro_vision` · `extro_voice` | `PWN::AI::Agent::Extrospection` (+ Serial/Packet/OCR/Voice/BareSIP/TransparentBrowser/GQRX) → `~/.pwn/extrospection.json` |
 | `cron` | `cron_list` · `cron_create` · `cron_run` · `cron_enable` · `cron_disable` · `cron_remove` | `PWN::Cron` → `~/.pwn/cron/jobs.yml` |
 | `swarm` | `agent_list` · `agent_spawn` · `agent_ask` · `agent_debate` · `agent_broadcast` · `swarm_bus` · `swarm_list` · `agent_roster` | `PWN::AI::Agent::Swarm` → `~/.pwn/agents.yml` + `~/.pwn/swarm/` |
 | `manifest` | `host_os_type` | YAML tool declarations in `lib/pwn/ai/tools/*.yaml` via `PWN::AI::Agent::Manifest` |
@@ -86,11 +86,11 @@ PWN::AI::Agent::Registry.definitions(relevance: 'nmap sweep 10.0.0.0/8', top_k:
 PWN::AI::Agent::Registry.rank(query: 'run a shell command')   # inspect ranking
 PWN::AI::Agent::Registry.preference_order                     # Env / DEFAULT_PREFERENCE
 PWN::AI::Agent::Registry.toolsets                              # -> the 16 names above
-PWN::AI::Agent::Registry.all.count                             # -> 146 (after discover)
+PWN::AI::Agent::Registry.all.count                             # -> 150 (after discover)
 ```
 
-Frontier engines leave `tool_router` off (unless you set it) and receive the
-full set. Local engines (`ollama` / `openwebui`) default `tool_router` to on.
+This broader Registry behavior does not override normal Loop's core-only
+selection. Frontier engines default `tool_router` off for broader callers. Local engines (`ollama` / `openwebui`) default `tool_router` to on.
 
 ## Durable long-running jobs
 
@@ -186,7 +186,8 @@ bound to this turn's contract ID. Finalization rechecks the current file against
 that evidence. Textual delivery claims, mere existence, old-turn observations,
 and files changed after readback cannot satisfy the gate. A proven current-turn
 write delta takes precedence over filesystem timestamp clock-tick lag.
-Nested calls inherit the contract and restore it on return. Historical mistake
+Nested calls bind their own contract and restore the parent scope on return;
+only current, exact-target child receipts can cross into parent acceptance. Historical mistake
 entries are not deleted by this enforcement.
 
 ## Retry checkpoints
@@ -194,8 +195,10 @@ entries are not deleted by this enforcement.
 The identical-payload checkpoint distinguishes retries from successful repeats.
 A structured nonzero exit or timeout resets that payload's repeat count and
 does not extinguish the payload through the repeated-failure guard. The command
-can therefore be retried verbatim; timeout retries still use Dispatch's existing
-deadline escalation and cumulative budget. Successful repeats retain the
+can be retried on legacy standalone Dispatch paths, subject to deadline
+escalation and cumulative budget. Runtime-owned requests preserve caller
+deadlines and refuse uncertain mutations across restart; changing an action ID
+does not make their side effects safe to replay. Successful repeats retain the
 checkpoint. Policy denials, exhausted budgets, checkpoint responses, and text
 in stdout do not grant an execution-failure exemption. Actual command failures
 remain recorded; the exemption does not erase historical mistake entries.

data/documentation/Blockchain.md

@@ -106,10 +106,11 @@ failures propagate; malformed/unsupported returned ABI layouts are marked unavai
 ## Verification
 
 Default specs use deterministic transport fixtures and need no live credentials.
-Read-only live checks also exercised BTC chain/block/transaction/ancestor/UTXO/date/
+The earlier implementation report recorded read-only live checks exercising BTC chain/block/transaction/ancestor/UTXO/date/
 address/mempool paths against the configured unpruned mainnet node, and Ethereum
 chain/block/receipt/pinned-account/activity/Transfer-log/USDC-metadata paths against
-a public mainnet RPC. These checks establish those observed paths, not universal
+a public mainnet RPC. Those historical checks were not repeated in this documentation audit. They
+establish only the reported paths, not universal
 provider compatibility or complete attribution. Never put RPC credentials in
 fixtures, documentation, logs, or generated skills.
 

data/documentation/Bounty.md

@@ -2,7 +2,7 @@
 
 | Module | Purpose |
 |---|---|
-| `PWN::Bounty::LifecycleAuthzReplay` | Record an authenticated browser session, then replay every request under a *different* principal to surface horizontal/vertical authz bugs |
+| `PWN::Bounty::LifecycleAuthzReplay` | Plan actor/surface/checkpoint coverage, record caller-supplied observations, and summarize stale-access evidence; it does not automatically replay HAR requests |
 
 Pairs naturally with:
 
@@ -11,11 +11,13 @@ Pairs naturally with:
 - [`PWN::Plugins::BurpSuite`](BurpSuite.md) - capture the session to replay
 
 ```ruby
-PWN::Bounty::LifecycleAuthzReplay.start(
-  har_path: 'admin_session.har',
-  replay_as: { cookie: 'session=LOW_PRIV_TOKEN' },
-  proxy: 'http://127.0.0.1:8080'
-)
+replay = PWN::Bounty::LifecycleAuthzReplay
+plan = replay.load_plan(yaml_path: '/path/to/lifecycle_authz_replay.yaml')
+run = replay.start_run(plan: plan, output_dir: '/tmp/authz-evidence')
+# Perform the authorized requests separately and record their actual results
+# with replay.record_observation(run_obj: run, checkpoint:, actor:, surface:,
+#                                status:, request:, response:, artifact_paths:).
+summary = replay.finalize_run(run_obj: run)
 ```
 
 [← Home](Home.md) · [WWW](WWW.md)

data/documentation/BurpSuite.md

@@ -11,20 +11,16 @@ Professional's headless mode + REST API.
 
 ## Configure
 
-```yaml
-# ~/.pwn/pwn.yaml  (edit via `pwn-vault`)
-burp:
-  jar: /opt/burpsuite_pro/burpsuite_pro.jar
-  api_key: <REST-API-KEY>
-  bind_ip: 127.0.0.1
-  proxy_port: 8080
-  api_port: 1337
-```
+`BurpSuite.start` takes `burp_jar_path`, `burp_ip`, `burp_port`,
+`pwn_burp_ip`, `pwn_burp_port`, `headless` and `browser_type` options.
+It uses the PWN Burp extension API; an arbitrary REST API key/config block is
+not an interchangeable adapter. Burp Professional and the matching extension
+must be provisioned separately. Use `.help` for the exact installed contract.
 
 ## Core methods
 
 ```ruby
-burp = PWN::Plugins::BurpSuite.start(headless: true)
+burp = PWN::Plugins::BurpSuite.start(headless: true, burp_port: 8080)
 
 # drive traffic through it
 b = PWN::Plugins::TransparentBrowser.open(

data/documentation/CLI-Drivers.md

@@ -1,6 +1,6 @@
 # CLI Drivers - `bin/pwn_*`
 
-54 headless executables (53 `pwn_*` + `pwn`), each a thin `OptionParser`
+56 executables (53 `pwn_*` + `pwn`, `pwn-ai`, `pwn-capd`), each a thin `OptionParser`
 wrapper over one plugin (or one workflow). They exist so CI/CD can call PWN
 without a REPL or an LLM.
 
@@ -9,6 +9,7 @@ without a REPL or an LLM.
 ## Full list
 
 ```text
+pwn-ai                             pwn-capd
 pwn                                pwn_jenkins_update_plugins
 pwn_ai_red_team                    pwn_jenkins_useradd
 pwn_android_war_dialer             pwn_mail_agent
@@ -38,7 +39,9 @@ pwn_jenkins_install_plugin         pwn_zaproxy_active_rest_api_scan
 pwn_jenkins_thinBackup_aws_s3      pwn_zaproxy_active_scan
 ```
 
-Run any with `--help` for its flags.
+Most drivers support `--help`; inspect source before assuming that convention.
+`pwn_msf_postgres_login` is positional (config, hosts, port) and does not have an
+OptionParser help path. Never probe it with `--help` against live credentials.
 
 ## `pwn_setup` - post-install doctor / provisioner / state migrator
 
@@ -78,8 +81,8 @@ sast:
   script:
     - pwn_setup --profile net --yes
     - pwn_setup --check                                   # gate: exit 1 if degraded
-    - pwn_sast -d "$CI_PROJECT_DIR" -o sast_out/
-    - pwn_defectdojo_importscan -f sast_out/report.json -e "$DD_ENGAGEMENT"
+    - pwn_sast --help  # use the installed driver's -u/-d/-n contract, not -o
+    # Add an explicitly configured authenticated import after verifying artifacts.
 ```
 
 ## Write your own

data/documentation/Capability-Broker-Sandbox.md

@@ -61,7 +61,7 @@ UID, socket and interface in sudoers. Only add engagement interfaces after
 operator review. CAP_NET_ADMIN is reserved for future neighbor management;
 current operations need CAP_NET_RAW, while neighbor queries are read-only.
 
-Ruby API (explicit require until central autoload is integrated):
+Ruby API (the central plugin namespace autoloads CapabilityBroker):
 
 ```ruby
 require 'pwn/plugins/capability_broker'

data/documentation/Configuration.md

@@ -1,8 +1,8 @@
 # Configuration - `~/.pwn/pwn.yaml`
 
-Everything configurable in PWN lives in **one encrypted YAML file**, loaded by
+Provider and plugin configuration lives in **one encrypted YAML file**, loaded by
 `PWN::Config.refresh_env` at driver startup and exposed in-process as the
-frozen constant **`PWN::Env`** (a redacted copy is available as
+constant **`PWN::Env`** (whose nested settings are mutable) (a redacted copy is available as
 `PWN::EnvRedacted`).
 
 The file is **AES-encrypted at rest** by `PWN::Plugins::Vault`. Its key/IV
@@ -146,7 +146,7 @@ ai:
     escalation_persona: escalator  # Swarm persona for a 3-line corrective hint after enough in-turn failures. nil = disabled.
     local_introspect: failure_only # End-of-turn auto_introspect policy for local engines: always | failure_only | every_n.
     policy: true                   # Live tabular Q / REINFORCE. Advisory only; never replaces TaskSummarizer / plan_first. false disables.
-    toolsets: ~                    # Allow-list of toolsets exposed to the agent. nil = all. Valid: cron, curriculum, extrospection, learning, memory, metrics, policy, pwn, reward, sessions, skills, swarm, terminal.
+    toolsets: ~                    # Allow-list of toolsets exposed to the agent. nil = all. Valid: cron, curriculum, extrospection, http, learning, manifest, mcp, memory, metrics, policy, pwn, reward, sessions, skills, swarm, terminal.
     extrospection:
       web:
         anchors:                   # URLs the headless browser fingerprints on extro_snapshot(sections:[:web]). Alias: web_anchors.
@@ -230,16 +230,17 @@ plugins:
       active: LongFast             # Which named channel block below `pwn-mesh` uses for TX/RX.
       LongFast:                    # Channel definition - name is arbitrary, referenced by `active:` above.
         psk: 'AQ=='                # Channel pre-shared key (base64). 'AQ==' = Meshtastic default public key. Redacted.
-        region: US/UT              # LoRa region tag (regulatory band).
+        region: US/UT              # Opaque MQTT topic prefix, NOT a firmware regulatory-band selector.
         topic: 2/e/#               # MQTT topic filter to subscribe/publish for this channel.
-        channel_num: 8             # Meshtastic channel index (slot number on the device).
+        channel_num: 8             # Legacy channel metadata, NOT a radio slot.
+        radio_index: 0            # Explicit enabled radio slot when needed; verify device configuration.
         from: '!deadbeef'          # Sender node id used on outbound packets. Optional - defaults to !<mqtt client_id>.
         short_name:                # Optional display name for that from node. When set, it replaces the last four bytes of from.
       PWN:                         # Example second (private) channel definition.
         psk: ...                     # Private channel pre-shared key (base64). Redacted.
-        region: US/UT              # LoRa region tag for this channel.
+        region: US/UT              # Opaque MQTT topic prefix for this channel.
         topic: 2/e/PWN/#           # MQTT topic filter for this channel.
-        channel_num: 99            # Meshtastic channel index for this channel.
+        channel_num: 99            # Legacy metadata; use radio_index for an explicit enabled device slot.
   shodan:
     api_key: ...                     # Shodan API key - passed as api_key: to PWN::Plugins::Shodan.*. Redacted.
 
@@ -279,6 +280,13 @@ PWN::Config.refresh_env
 
 ## Full key reference
 
+The Consumed by column includes private implementation helpers (for example
+Loop `plan_first`/`escalate` and Extrospection probes), not only public APIs.
+Use module `.help` for callable entry points. This annotated example is not a
+verbatim copy of every runtime default; the installed `Config.env_template` is
+the default schema, and migrations preserve existing operator values.
+
+
 ### `ai` - AI engines & agent loop
 
 | Key path | Type | Default | Consumed by | Purpose |
@@ -291,7 +299,7 @@ PWN::Config.refresh_env
 | `ai.<engine>.system_role_content` | String | ethical-hacker persona | `PWN::AI::Agent::PromptBuilder`, `PWN::Plugins::REPL` | Base system prompt prepended to MEMORY / SKILLS / LEARNING / EXTROSPECTION blocks. |
 | `ai.<engine>.temp` | Float | `1.0` | `PWN::AI::<Engine>.chat` | Sampling temperature. |
 | `ai.<engine>.max_prompt_length` | Integer | per-engine | `PWN::AI::<Engine>`, `PWN::Plugins::REPL` | Soft input-context ceiling used for prompt truncation / chunking. |
-| `ai.anthropic.max_tokens` | Integer | `8192` | `PWN::AI::Anthropic.chat_tool_loop` | Max **output** tokens per response. Raise if tool-call JSON truncates. |
+| `ai.anthropic.max_tokens` | Integer | `8192` | `PWN::AI::Anthropic.chat_with_tools` | Max **output** tokens per response. Raise if tool-call JSON truncates. |
 | `ai.openai.max_tokens` | Integer | `16384` | `PWN::AI::OpenAI.chat` | Max **output** tokens per response. Mapped to OpenAI's wire param `max_completion_tokens` (legacy env key `max_completion_tokens` still accepted). |
 | `ai.ollama.embed_model` | String | provider default | `PWN::MemoryIndex` | Local embedding model tag used to build `~/.pwn/memory.idx` for **relevance-ranked** MEMORY injection. Falls back to substring recall when unset / unreachable. |
 | `ai.ollama.num_ctx` | Integer | `32768` | `PWN::AI::Ollama.chat_with_tools` | Context window sent as `options.num_ctx` on the native `/api/chat` call. Ollama's own default (2048) truncates the pwn-ai system prompt. |
@@ -324,7 +332,7 @@ PWN::Config.refresh_env
 | `ai.agent.max_depth` | Integer | `3` | `PWN::AI::Agent::Swarm` | Recursion guard for `agent_ask` / `agent_debate` sub-agents spawning sub-agents. |
 | `ai.agent.auto_introspect` | Boolean | `true` | `PWN::AI::Agent::Learning.auto_introspect` | Run outcome logging + lesson mining after every final answer. Toggle live via `learning_auto_introspect_toggle`. |
 | `ai.agent.auto_extrospect` | Boolean | `true` | `PWN::AI::Agent::Extrospection.auto_extrospect` | Ambient baseline after every final answer (`AUTO_SECTIONS` = host/repo/env only; never spawns GUI/JVM tools). Sense tools (`intel`/`verify`/`watch`/`rf_tune`/`observe`) stay on-demand. Toggle live via `extro_auto_toggle`. |
-| `ai.agent.toolsets` | Array\<String\> \| `nil` | `nil` (all) | `bin/pwn`, `PWN::Plugins::REPL`, `PWN::AI::Agent::Registry` | Allow-list of toolsets exposed to the agent. Valid: `cron`, `curriculum`, `extrospection`, `learning`, `memory`, `metrics`, `policy`, `pwn`, `reward`, `sessions`, `skills`, `swarm`, `terminal`. |
+| `ai.agent.toolsets` | Array\<String\> \| `nil` | `nil` (all) | `bin/pwn`, `PWN::Plugins::REPL`, `PWN::AI::Agent::Registry` | Allow-list of toolsets exposed to the agent. Valid: `cron`, `curriculum`, `extrospection`, `http`, `manifest`, `mcp`, `learning`, `memory`, `metrics`, `policy`, `pwn`, `reward`, `sessions`, `skills`, `swarm`, `terminal`. |
 | `ai.agent.shell_bash` | Boolean | `false` | `PWN::AI::Agent::ToolGuard.shell_bash?` | When true, `shell` runs via `bash -lc` so bash-only syntax is allowed. Default is POSIX `/bin/sh` and bashisms are rejected with a rewrite hint. |
 | `ai.agent.plan_first` | Boolean \| `nil` | `nil` (auto: `true` when `ai.active` is `ollama` or `openwebui`) | `PWN::AI::Agent::Loop.plan_first` | Plan-then-act pre-pass: the model must emit a numbered tool plan (as an assistant message) *before* it may dispatch anything. Cheap chain-of-thought scaffolding for local models. |
 | `ai.agent.tool_router` | Boolean \| `nil` | `nil` (auto: `true` for `ollama` / `openwebui`) | `PWN::AI::Agent::Registry.definitions` | Dynamic tool-set slimming: expose only `Registry::CORE_TOOLS` + the top-K keyword-relevant schemas for *this* request. Ties break on historical `Metrics` success rate, then `ai.agent.tool_preference`. |
@@ -336,12 +344,12 @@ PWN::Config.refresh_env
 | `ai.agent.critic` | Boolean \| `nil` | `nil` (auto: on for remote, off for ollama) | `PWN::AI::Agent::Curriculum.critic` | Tool-armed constitutional self-critic reviews (and may `shell`/`extro_verify`) every final answer before it is returned. |
 | `ai.agent.red_team_plan` | Boolean \| `nil` | `nil` (auto: on for remote, off for ollama) | `PWN::AI::Agent::Curriculum.red_team_plan` | Adversarial review of the `plan_first` numbered plan, grounded in Metrics/Mistakes/`extro_drift` telemetry, before the first dispatch. |
 | `ai.agent.counterfactual` | Boolean \| `nil` | `nil` (auto: on for remote, off for ollama) | `PWN::AI::Agent::Curriculum.counterfactual` | On `[REPEATING]`, fork an alt-persona branch, judge both, and record the `(loser, winner)` DPO preference pair. |
-| `ai.agent.hindsight` | Boolean | `true` | `PWN::AI::Agent::Curriculum.hindsight` | Hindsight Experience Replay - relabel a failed trajectory as `success:true` for whatever it *did* accomplish. Free positive samples from failures. |
+| `ai.agent.hindsight` | Boolean | `true` | `PWN::AI::Agent::Curriculum.hindsight` | Hindsight Experience Replay - record what a failed trajectory did accomplish as `success: 'soft'`; excluded from hard supervised success export. |
 | `ai.agent.policy` | Boolean | `true` | `PWN::AI::Agent::Policy` | Live tabular Q-learning + REINFORCE. Records `(s,a,r,s')` per tool step, trains on `Reward.judge` at episode end, and adds a small Q-advantage term to `Registry.rank`. Advisory only: never replaces TaskSummarizer or plan_first. |
 | `ai.agent.reward_llm` | Boolean \| `nil` | `nil` (auto: on for remote, off for ollama) | `PWN::AI::Agent::Reward.judge` / `.prm` | Use a cheap LLM teacher for outcome/process judges even when `module_reflection` is false. Local ollama stays heuristic unless this is `true`. |
 | `ai.agent.reward_model` | String \| `nil` | `nil` | `Reward.judge` / `.prm` | Optional cheaper model id for the ORM/PRM chat. Falls back to `ai.reflect_model`, then the active engine default. |
 | `ai.agent.reward_llm_timeout` | Integer | `12` | `Reward.judge` / `.prm` | Seconds for the cheap ORM chat (clamped 2..30). Fail fast to the overlap heuristic rather than a 900s hang. |
-| `ai.agent.verify_as_reward` | Boolean \| `nil` | `nil` (auto: ~10% local / always frontier when a claim matches) | `PWN::AI::Agent::Reward.verify_as_reward` | Ground the LLM judge score by browser-verifying any checkable claim in the final via `extro_verify`; verdict caps/floors `Reward.judge`. |
+| `ai.agent.verify_as_reward` | Boolean \| `nil` | `nil` (auto: ~10% local / always frontier when a claim matches) | `PWN::AI::Agent::Reward.verify_as_reward` | Ground the LLM judge score by browser-verifying any checkable claim in the final via `extro_verify`; refutation can cap the judge; one confirmed claim cannot establish whole-request completion. |
 | `ai.agent.extrospection.web.anchors` | Array\<String\> | `DEFAULT_WEB_ANCHORS` | `PWN::AI::Agent::Extrospection.probe_web` | URLs the headless browser fingerprints on `extro_snapshot(sections:[:web])`. Alias: `web_anchors`. |
 | `ai.agent.extrospection.web.proxy` | String | - | `Extrospection.probe_web` / `.verify` / `.watch` | Upstream proxy for `PWN::Plugins::TransparentBrowser` (e.g. `tor`, `http://127.0.0.1:8080`). |
 | `ai.agent.extrospection.web.max_anchors` | Integer | `8` | `Extrospection.probe_web` | Cap on anchors rendered per snapshot. |
@@ -400,9 +408,9 @@ PWN::Config.refresh_env
 | `plugins.meshtastic.mqtt.ack_timeout` | Integer | `5` | `pwn-mesh` | Optional MQTT ack timeout seconds. |
 | `plugins.meshtastic.channel.active` | String | `LongFast` | `pwn-mesh` | Which named channel block below is used for TX/RX. |
 | `plugins.meshtastic.channel.<NAME>.psk` | String (b64) | `AQ==` | `pwn-mesh` | Channel pre-shared key. |
-| `plugins.meshtastic.channel.<NAME>.region` | String | - | `pwn-mesh` | LoRa region tag (e.g. `US/UT`). |
+| `plugins.meshtastic.channel.<NAME>.region` | String | - | `pwn-mesh` | Complete opaque MQTT prefix (e.g. `US/UT`), not the firmware regulatory region. |
 | `plugins.meshtastic.channel.<NAME>.topic` | String | - | `pwn-mesh` | MQTT topic filter to subscribe/publish (e.g. `2/e/#`). |
-| `plugins.meshtastic.channel.<NAME>.channel_num` | Integer | - | `pwn-mesh` | Meshtastic channel index. |
+| `plugins.meshtastic.channel.<NAME>.channel_num` | Integer | - | `pwn-mesh` | Legacy channel metadata, not a radio slot; use `radio_index` or resolved device channel metadata. |
 | `plugins.meshtastic.channel.<NAME>.from` | String | `!<mqtt client_id>` | `pwn-mesh` | Sender node id used on outbound packets. |
 | `plugins.meshtastic.channel.<NAME>.short_name` | String | - | `pwn-mesh` | Optional short name for that `from` node. A non-empty value is shown instead of the last four bytes of `from`. |
 | `plugins.shodan.api_key` | String | - | `PWN::Plugins::Shodan` | Shodan API key (passed as `api_key:` to `Shodan.*`). |
@@ -458,8 +466,8 @@ agent system prompt.
 
 ## Related files under `~/.pwn/`
 
-`pwn.yaml` is the only file you edit; everything else is machine-written
-state. See **[Persistence](Persistence.md)** for the full map
+`pwn.yaml` is edited through the vault UI. Personas and SOP skills have
+separate operator-editable files; other files include machine-written state. See **[Persistence](Persistence.md)** for the full map
 (`.schema`, `memory.json`, `memory.idx`, `learning.jsonl`,
 `preferences.jsonl`, `mistakes.json`, `metrics.json`,
 `reward_sentinel.json`, `extrospection.json`, `sessions/`,

data/documentation/Contributing.md

@@ -6,10 +6,10 @@
 lib/pwn/                # all namespaces
 lib/pwn/setup.rb        # PWN::Setup - doctor/provisioner data tables
 lib/pwn/migrate.rb      # PWN::Migrate - ~/.pwn state doctor / auto-migrator
-lib/pwn/plugins/        # 67 plugin modules
+lib/pwn/plugins/        # 107 top-level plugin autoloads
 lib/pwn/ai/agent/       # agent core
 lib/pwn/ai/agent/tools/ # LLM tool registrations
-bin/                    # 54 executables: 53 pwn_* drivers + pwn (incl. pwn_setup)
+bin/                    # 56 executables: 53 pwn_* drivers + pwn / pwn-ai / pwn-capd (incl. pwn_setup)
 spec/                   # RSpec (incl. conventions_spec)
 documentation/          # this wiki + diagrams
 ```
@@ -25,7 +25,7 @@ documentation/          # this wiki + diagrams
 ## Quality gates
 
 ```bash
-rake            # rubocop + rspec - must be zero offenses
+bundle exec rake  # RSpec, RuboCop, then RDoc; await the actual exit status
 ```
 
 (`rvmsudo rake` on multi-user RVM installs.)

data/documentation/Cron.md

@@ -36,7 +36,7 @@ does not remove existing per-job lines.
 
 ## Seeded self-improvement jobs (`PWN::Cron.install_defaults`)
 
-`pwn setup --migrate` (schema `v1`) seeds five jobs into every fresh
+`pwn setup --migrate` and first-launch default installation seed six jobs into a fresh
 `~/.pwn/cron/jobs.yml` via `PWN::Cron.install_defaults`:
 
 | Name | Schedule | Enabled | Ruby |
@@ -44,11 +44,12 @@ does not remove existing per-job lines.
 | `curriculum_practice_nightly` | `0 3 * * *` | **no** | `Curriculum.practice(limit: 3)` - opt-in; runs `Loop.run` with real tools |
 | `curriculum_offline_judge` | `30 3 * * *` | **no** | `Curriculum.offline_judge(...)` - opt-in; spends API tokens |
 | `curriculum_train_weekly` | `0 4 * * 0` | **no** | `Curriculum.train_and_gate(dry_run: true)` - opt-in; needs trainer+GPU to actually train |
+| `session_cleanup` | `45 3 * * *` | **yes** | Guarded unsummarized-session cleanup with backups, dependency checks and activity leases; see [Installation](Installation.md) |
 | `learning_consolidate_nightly` | `0 5 * * *` | **yes** | `Learning.consolidate` - memory GC |
 | `pwn_stores_lean_nightly` | `15 5 * * *` | **yes** | `Learning.gc_stores!` - lean memory, learning.jsonl, mistakes, policy, sessions |
 
 - **practice / judge / train** ship **disabled**. Practice self-plays via `Loop.run` (shell, browsers). Judge hits the live model. Train is a no-op without a LoRA trainer. Enable with `cron_enable` when you want that loop.
-- **consolidate + lean** stay on: they only touch `~/.pwn` files so the injected MEMORY / LEARNING / session tail stays high-signal.
+- **consolidate + lean + session cleanup** stay on: they operate on local `~/.pwn` state; cleanup can delete eligible transcripts after verified backups and guards, so the injected MEMORY / LEARNING / session tail stays high-signal.
 
 - **practice** - top unresolved `Mistakes` under `Reward.judge`; auto-`resolve` with ≥2 holdouts
 - **offline_judge** - backfill outcome/process labels + plan calibration from PLAN `p(success)=` so `:failure_only` local introspect does not starve the corpus; also runs `Reward.warm_sentinel` so the reward-sentinel window can fill on local hosts

data/documentation/Diagrams.md

@@ -8,8 +8,9 @@
 cd documentation/diagrams && ./build.sh
 ```
 
-Every diagram uses strict layer→layer edges (`newrank=true` + `{rank=same}`
-groups) so lines never criss-cross.
+Diagrams distinguish implemented control/data paths from illustrative operator
+workflows. Cross-links and feedback can cross visually; Graphviz ranking is not
+a dependency guarantee. External services/radios require separate live verification.
 
 ---
 
@@ -23,7 +24,7 @@ groups) so lines never criss-cross.
 [source](diagrams/dot/persistence-filesystem.dot) · doc: [Persistence](Persistence.md)
 ![persistence-filesystem](diagrams/persistence-filesystem.svg)
 
-### Plugin Ecosystem (67 modules)
+### Plugin Ecosystem (107 modules)
 [source](diagrams/dot/plugin-ecosystem.dot) · doc: [Plugins](Plugins.md)
 ![plugin-ecosystem](diagrams/plugin-ecosystem.svg)
 
@@ -96,6 +97,11 @@ groups) so lines never criss-cross.
 
 ## 4 · Security Workflows
 
+These diagrams show operator-composed workflows, not automatic call chains or
+proof that the named service is available. In particular, SDK wrappers need
+explicit credentials, scanners produce leads, and exports/imports are separate
+operations. See [Operability](Operability.md).
+
 ### End-to-End Penetration Test
 [source](diagrams/dot/penetration-testing-workflow.dot)
 ![penetration-testing-workflow](diagrams/penetration-testing-workflow.svg)

data/documentation/Drivers.md

@@ -1,8 +1,8 @@
 # Drivers - Turn a REPL Session into a Shipped Binary
 
 A **driver** is a small executable in `bin/` that wires `OptionParser` to one
-or more `PWN::` calls. All 53 shipped `pwn_*` binaries follow the same
-15-line template.
+or more `PWN::` calls. The example below is a minimal pattern, not a claim
+that every driver has the same options or implementation.
 
 ![History → Driver → CI](diagrams/history-to-drivers.svg)
 
@@ -11,7 +11,8 @@ or more `PWN::` calls. All 53 shipped `pwn_*` binaries follow the same
 1. **Prototype in the REPL** until the calls work.
 2. `history` → copy the winning lines.
 3. Drop them into the template below as `bin/pwn_<name>`.
-4. `chmod +x bin/pwn_<name>` · add to `pwn.gemspec` executables · `rake install`.
+4. `chmod +x bin/pwn_<name>`; track it in Git for gemspec discovery and test it
+   before `bundle exec rake install`. Do not commit or publish without review.
 5. (Optional) `learning_distill_skill(name: '<name>')` so the agent knows the
    procedure too.
 
@@ -23,6 +24,8 @@ or more `PWN::` calls. All 53 shipped `pwn_*` binaries follow the same
 
 require 'optparse'
 require 'pwn'
+require 'json'
+require 'fileutils'
 
 opts = {}
 OptionParser.new do |o|
@@ -33,9 +36,12 @@ end.parse!
 
 raise OptionParser::MissingArgument, '-t' unless opts[:target]
 
-result = PWN::Plugins::NmapIt.port_scan(target: opts[:target])
-PWN::Reports::Fuzz.generate(result: result, dir_path: opts[:out]) if opts[:out]
-puts result
+raise OptionParser::MissingArgument, '-o' unless opts[:out]
+FileUtils.mkdir_p(opts[:out])
+xml = File.join(opts[:out], 'scan.xml')
+PWN::Plugins::NmapIt.port_scan(targets: opts[:target], xml: xml)
+result = PWN::Plugins::NmapIt.inventory(xml_file: xml)
+puts JSON.pretty_generate(result)
 ```
 
 ## Three artifact types from one REPL session

data/documentation/Extrospection.md

@@ -7,6 +7,25 @@ say when I need it for a better answer?"*
 
 **Primary intent = sense tools on demand**, not ambient inventory of the local host.
 
+## Evidence boundaries and living off the land
+
+`PWN::Plugins::DetectOS.living_off_the_land` inventories executable names on PATH
+plus present optional `bins:` in `native`, and reports OS/architecture,
+raw-socket capability and Docker observations. `PromptBuilder` adds its summary
+to the HOST block as `LIVING OFF THE LAND`. This is local capability evidence,
+not permission, proof of tool health, or a reason to install missing software
+automatically. Tests can supply `which:` to replace PATH discovery, plus explicit OS, capability
+and Docker fixtures to avoid other host reads. Only the OS summary is injected
+from this API; PreflightChecker supplies separate plugin-health information.
+
+Extrospection supplies observations and correlation candidates, not causal proof
+or whole-request completion. `extro_verify` uses source-specific heuristics;
+token overlap and a reachable page cannot establish arbitrary factual truth.
+Confirmed claims cannot override failed host acceptance checks. Feed entries
+below describe implemented adapters, not currently verified endpoint availability
+or access entitlements. RF tuning, serial writes, calls and packet capture are
+active operations; this documentation audit did not exercise them.
+
 | You need... | Call... |
 |---|---|
 | Weather / public page content | `extro_watch` / `extro_verify` / TransparentBrowser |
@@ -104,7 +123,7 @@ Override / extend via `PWN::Env[:ai][:agent][:extrospection][:web][:anchors]`; s
 (g) :intel obs whose feed anchor is    ×  probe_web-unreachable → downgrade weight
 ```
 
-Output tells the agent whether a failure was **its own fault** ("I called the
+Output suggests whether a failure may be **its own fault** ("I called the
 API wrong" → belongs in [Mistakes](Mistakes.md)) or **the world changed**
 ("nmap was upgraded and the flag moved", "the HackRF was unplugged") - and
 that distinction is written back into MEMORY so the next run doesn't waste
@@ -112,8 +131,9 @@ iterations rediscovering it.
 
 ## `extro_verify` - proactive fact-checking (the browser as a sense organ)
 
-`probe_rf` is a passive **ear inventory**; `extro_rf_tune` actually **listens** (tune + RDS). `PWN::Plugins::TransparentBrowser` gives Extrospection **eyes**. `extro_verify(claim:)` renders a canonical source *with JavaScript
-executed* and returns a verdict:
+`probe_rf` inventories interfaces; `extro_rf_tune` tunes and samples RDS.
+`extro_verify(claim:)` attempts browser rendering, with a REST fallback that does
+not execute JavaScript, and returns a heuristic verdict:
 
 | `kind:` | Canonical source (rendered headless) | Verdict logic |
 |---|---|---|
@@ -254,7 +274,7 @@ unreachable endpoints return `{error:...}` instead of raising.
 | `:agify` / `:genderize` / `:nationalize` | agify.io · genderize.io · nationalize.io | First-name age/gender/nationality estimates |
 | `:haveibeenpwned` | haveibeenpwned.com v3 | Breach membership - **needs** `HIBP_API_KEY` |
 | `:securitytrails` | api.securitytrails.com | Domain DNS history - **needs** `SECURITYTRAILS_API_KEY` |
-| `:keybase` | keybase.io lookup API | **crypto-proven** cross-links (Twitter/GitHub/DNS/PGP) → highest-confidence pivots |
+| `:keybase` | keybase.io lookup API | Service-reported proof metadata/cross-links; not independent local cryptographic verification or proof of real-world identity |
 | `:gravatar` | gravatar.com profile JSON | email → md5 → username, verified accounts, bio, urls |
 | `:mastodon` | `<instance>/api/v1/accounts/lookup` + WebFinger | Fediverse identity; instance defaults to `mastodon.social` |
 | `:bluesky` | public.api.bsky.app `getProfile` | DID, handle, followers, bio |
@@ -452,7 +472,7 @@ cron_create(name: 'memory_revalidate', schedule: '0 4 * * 0',
 
 ```ruby
 PWN::Env[:ai][:agent][:extrospection][:web] = {
-  anchors:          ['https://target.acme/api/version', ...],  # else DEFAULT_WEB_ANCHORS
+  anchors:          ['https://target.example.com/api/version'],  # else DEFAULT_WEB_ANCHORS
   proxy:            'tor',      # or 'http://127.0.0.1:8080' (Burp) - honored by verify/watch/probe_web
   max_anchors:      8,
   per_page_timeout: 15,