pwn 0.5.724 → 0.5.725

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b1c409d6b05e3c061837ef187c74d22ff5e24d361aee4531be0943714a8f713b
-  data.tar.gz: dacfce51246aee0f02c84b5a8eae1651fe2853db2e0f192343c5fc8cfbc5462b
+  metadata.gz: 3ada4e79d8d8864ce2ea48b7378b4d10e124e7925d050424d3ef10e269438d5f
+  data.tar.gz: 714c044b1ab48bf33ca175d73fee3997d0788ed9d34e6c124d59c7fdf630c01e
 SHA512:
-  metadata.gz: 6c29fd2cde7775f1923249f166af195dcc99ed0614c86536d3aeb56bcc7a3d29a28a3483b1b2c25bb736b2b78b28ab92a0906d690cd71d002ff335c41e1e5d78
-  data.tar.gz: cbcf28e1681df68a21a1da6f247bf645de861ee2a752af2f3735f09f2a59501bdd9d5fb5bf238dcc39ae2734ea173a3d515ddb3df1de2d7548de4fbbb67c5ea7
+  metadata.gz: 2472a6aa034cd281f4b2b67804558b7f40827abfca843857b7f713d1c492a9ea1e3c2bfd03282134bc2d2270e1db77cdc7c20876b0f4baf58d5b36c929ba536f
+  data.tar.gz: e7550328388a59e8d4047bceef0da28446850c2b0d40670930e104ea3ca7a89559aa65db510bd2d2e60f02053f85a98890a5bd96fee7d0435d1a53c845a5fe44

data/Gemfile

@@ -49,7 +49,7 @@ gem 'jwt', '3.2.0'
 gem 'libusb', '0.8.0'
 gem 'luhn', '3.0.0'
 gem 'mail', '2.9.1'
-gem 'mcp', '1.5.0'
+gem 'mcp', '1.5.1'
 gem 'meshtastic', '0.0.175'
 gem 'metasm', '1.0.6'
 gem 'mongo', '2.25.0'
@@ -89,8 +89,8 @@ gem 'ruby-nmap', '1.0.3'
 gem 'ruby-saml', '1.18.1'
 gem 'rvm', '1.11.3.9'
 gem 'savon', '2.17.4'
-gem 'selenium-devtools', '0.152.0'
-gem 'selenium-webdriver', '4.48.0'
+gem 'selenium-devtools', '0.153.0'
+gem 'selenium-webdriver', '4.49.0'
 gem 'slack-ruby-client', '3.2.0'
 gem 'socksify', '1.8.1'
 gem 'spreadsheet', '1.3.5'

data/bin/pwn-ai

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn/ai/cli'
+
+exit PWN::AI::CLI.run(argv: ARGV)

data/bin/pwn-capd

@@ -0,0 +1,5 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Packaging-compatible driver; privileged deployments execute daemon.py directly.
+exec('/usr/bin/python3', '-I', File.expand_path('../lib/pwn/plugins/capability_broker/daemon.py', __dir__), *ARGV)

data/documentation/AI-Integration.md

@@ -113,8 +113,9 @@ puts resp[:content]
 
 ## Model diversity in Swarm
 
-Because each persona in [`agents.yml`](Swarm.md) can override `engine:`, an
-`agent_debate` can pit several *different providers* against each other - real
+Because each persona in [`agents.yml`](Swarm.md) can override `engine:` and
+`model:`, an `agent_debate` can compare different models on the same provider
+or several *different providers* against each other - real
 antagonism, not one model role-playing three voices. The same mechanism backs
 `ai.agent.escalation_persona`: when a local model is stuck, `Loop.run` asks a
 frontier persona for a 3-line corrective hint and injects it as a synthetic

data/documentation/Agent-Tool-Registry.md

@@ -10,10 +10,11 @@ toolsets; the JSON-Schema for each tool is what the model actually sees.
 
 | Toolset | Tools | Backed by |
 |---|---|---|
+| `http` | `http_proxy_start` · `http_proxy_stop` · `http_proxy_entries` · `http_proxy_rules` · `http_replay` | `PWN::Plugins::MitmProxy`: native HTTP HAR capture/replay; opaque CONNECT tunnels |
 | `terminal` | `shell` | `Open3.capture3` on the host, after `PWN::AI::Agent::ToolGuard` |
 | `pwn` | `pwn_eval` | `TOPLEVEL_BINDING.eval` in the live REPL process, after `ToolGuard` |
 | `memory` | `memory_remember` · `memory_recall` · `memory_forget` · `memory_clear` · **`memory_lean`** | `PWN::Memory` → `~/.pwn/memory.json` |
-| `skills` | **`skills_recall`** · `skill_list` · `skill_view` · `skill_create` · `skill_add_reference` · `skill_delete` · `skill_migrate_legacy` | `~/.pwn/skills/<name>/SKILL.md` (**[agentskills.io](https://agentskills.io) spec**; legacy flat `*.md` auto-migrated) |
+| `skills` | `skills_consolidate` · **`skills_recall`** · `skill_list` · `skill_view` · `skill_create` · `skill_add_reference` · `skill_delete` · `skill_migrate_legacy` | `~/.pwn/skills/<name>/SKILL.md` (**[agentskills.io](https://agentskills.io) spec**; legacy flat `*.md` auto-migrated) |
 | `sessions` | **`session_recall`** · `sessions_list` · `sessions_view` · `sessions_current` · `sessions_delete` · `sessions_stats` · **`sessions_lean`** | `PWN::Sessions` → `~/.pwn/sessions/` |
 | `learning` | `learning_note_outcome` · `learning_reflect` · `learning_distill_skill` · `learning_stats` · `learning_outcomes` · `learning_consolidate` · `learning_reset` · `learning_auto_introspect_toggle` · **`learning_gc_stores`** · **`learning_purge_noise`** · **`mistakes_list`** · **`mistakes_record`** · **`mistakes_resolve`** · **`mistakes_reset`** · **`mistakes_lean`** · **`reward_judge`** · **`reward_prm`** · **`reward_sentinel`** · **`reward_preferences`** · **`reward_export_dpo`** · **`reward_warm_sentinel`** · **`reward_scrub_preferences`** · **`reward_preference_balance`** · **`curriculum_practice`** · **`curriculum_train`** · **`curriculum_hindsight`** · **`curriculum_offline_judge`** · **`curriculum_preference_balance`** | `PWN::AI::Agent::Learning` + `Mistakes` + `Reward` + `Curriculum` → `~/.pwn/learning.jsonl` + `~/.pwn/mistakes.json` + `~/.pwn/preferences.jsonl` + `~/.pwn/curriculum/` + `~/.pwn/finetune/` |
 | `reward` | **`reward_generator_mix`** | `PWN::AI::Agent::Reward.generator_mix` → online preference source-mix controller (`preferences.jsonl`) |
@@ -23,6 +24,7 @@ toolsets; the JSON-Schema for each tool is what the model actually sees.
 | `extrospection` | `extro_snapshot` · `extro_drift` · `extro_observe` · `extro_observations` · `extro_intel` · **`extro_watch`** · **`extro_verify`** · **`extro_rf_tune`** · **`extro_osint`** · **`extro_serial`** · **`extro_telecomm`** · **`extro_packet`** · **`extro_vision`** · **`extro_voice`** · `extro_correlate` · `extro_stats` · `extro_reset` · `extro_auto_toggle` | `PWN::AI::Agent::Extrospection` (+ Serial/Packet/OCR/Voice/BareSIP/TransparentBrowser/GQRX) → `~/.pwn/extrospection.json` |
 | `cron` | `cron_list` · `cron_create` · `cron_run` · `cron_enable` · `cron_disable` · `cron_remove` | `PWN::Cron` → `~/.pwn/cron/jobs.yml` |
 | `swarm` | `agent_list` · `agent_spawn` · `agent_ask` · `agent_debate` · `agent_broadcast` · `swarm_bus` · `swarm_list` | `PWN::AI::Agent::Swarm` → `~/.pwn/agents.yml` + `~/.pwn/swarm/` |
+| `manifest` | `host_os_type` | YAML tool declarations in `lib/pwn/ai/tools/*.yaml` via `PWN::AI::Agent::Manifest` |
 
 The `learning` toolset is deliberately large: **Mistakes** (negative feedback),
 **Reward** (outcome and process judges, sentinel, preference ledger) and

data/documentation/Capability-Broker-Sandbox.md

@@ -0,0 +1,97 @@
+# Capability broker and disposable sandbox
+
+## pwn-capd (P8)
+
+The Python stdlib helper speaks one bounded JSON request per Unix connection.
+Linux SO_PEERCRED authenticates the configured caller UID; the client also
+checks the daemon UID. The socket is mode 0600. Only explicitly configured
+interfaces are accepted. Operations: `status`, `raw_send` (base64 Ethernet
+frame), `capture` (bounded in-memory pcap), `arp` / `nd` (typed IP kernel
+neighbor-cache queries). There is no command endpoint, arbitrary privileged
+output path, firewall mutation, or implicit sudo. ARP/ND currently query cache;
+they do not actively solicit neighbors or mutate entries.
+
+Operator installation (NOT executed by the application): install
+`lib/pwn/plugins/capability_broker/daemon.py` (not the Ruby packaging driver)
+root-owned under `/usr/local/libexec/pwn-capd`, mode 0755, in a root-owned
+non-writable directory. Do **not** setcap the system Ruby/Python interpreter
+or this script: Linux ignores script file capabilities, and granting a shared
+interpreter network privileges exposes every script. Use a dedicated systemd
+service with `User=<operator>`,  `AmbientCapabilities=CAP_NET_RAW CAP_NET_ADMIN`,
+`CapabilityBoundingSet=CAP_NET_RAW CAP_NET_ADMIN`, `NoNewPrivileges=yes`,
+`ProtectSystem=strict`, `ProtectHome=yes`, `RuntimeDirectory=pwn-capd`,
+`RestrictAddressFamilies=AF_UNIX AF_PACKET AF_NETLINK`, and the reviewed helper
+as ExecStart. The socket owner and configured peer UID must match that operator.
+Enable a preconfigured unit with `sudo systemctl start pwn-capd`.
+For an audited one-shot sudo launch use:
+
+```
+sudo /usr/local/libexec/pwn-capd --uid "$(id -u)" --interface lo
+```
+
+Never authorize unrestricted sudo access to arbitrary helper arguments. Pin
+UID, socket and interface in sudoers. Only add engagement interfaces after
+operator review. CAP_NET_ADMIN is reserved for future neighbor management;
+current operations need CAP_NET_RAW, while neighbor queries are read-only.
+
+Ruby API (explicit require until central autoload is integrated):
+
+```ruby
+require 'pwn/plugins/capability_broker'
+PWN::Plugins::CapabilityBroker.request(operation: 'status')
+PWN::Plugins::CapabilityBroker.request(operation: 'arp', iface: 'lo', address: '127.0.0.1')
+PWN::Plugins::CapabilityBroker.request(operation: 'nd', iface: 'lo', address: '::1')
+# Packet.send(pkt:, iface:, socket:) and Packet.capture(path:, count:, timeout:, iface:, socket:)
+```
+
+`PWN_CAPD_SOCKET` overrides `/run/pwn-capd/control.sock`. Capture artifacts are
+written and read back by the unprivileged client, never by the daemon.
+Absent broker returns degraded error and missing local CAP_NET_RAW accurately;
+there is no fabricated capture path or privileged Ruby remediation.
+
+## Sandbox (P13)
+
+```ruby
+require 'pwn/plugins/sandbox'
+PWN::Plugins::Sandbox.run(binary: '/path/safe-fixture', argv: [], stdin: '', timeout: 10, memory_mb: 256)
+PWN::Plugins::Sandbox.fuzz(target: '/path/safe-fixture', corpus: '/path/seeds', minutes: 1, seed: 0)
+s = PWN::Plugins::Sandbox.snapshot(binary: '/path/safe-fixture')
+PWN::Plugins::Sandbox.rollback(snapshot: s[:snapshot], backend: 'bwrap')
+```
+
+Docker is default, image `pwn-sandbox:local`; it must be provisioned locally,
+with `/usr/bin/python3`, strace, GDB, and target runtime libraries. No implicit
+pull, installation, daemon startup or host-execution fallback occurs. Use the
+included `lib/pwn/plugins/sandbox/Dockerfile` to build explicitly. Network none,
+read-only root/artifacts, unprivileged UID, all caps dropped, no-new-privileges,
+pid/cpu/memory/swap constraints, disposable bounded tmpfs, forced cleanup.
+Instrumentation runs are separate replays with the same input, not observation
+of the original execution. Signals, PC, backtrace, raw GDB output are returned;
+exploitable classification is `unknown` if the GDB plugin is absent. No invented
+classification. Current `-nx` configuration deliberately does not load arbitrary
+user GDB startup scripts. Install a reviewed exploitable plugin into the image
+and extend its explicit initialization if classification is required.
+
+Explicit `backend: 'bwrap'` works without a Docker daemon where unprivileged
+user namespaces are permitted. It exposes only read-only system runtime trees
+and target artifact, creates fresh user/network/PID/mount namespaces, and hides
+home. It is a **weaker resource tier**: per-process RLIMIT_AS, not an aggregate
+cgroup budget or fork-bomb protection. Use Docker/microVM for hostile samples.
+No automatic backend fallback. Snapshot/rollback means verified immutable input
+copies and fresh disposable environments, **not live process/VM checkpoints**.
+Fuzzing is bounded seeded bit-flip stdin mutation, not coverage-guided AFL.
+
+Tools register via `require 'pwn/ai/agent/tools/sandbox'`: `sandbox_run` and
+`sandbox_fuzz`; normal Registry discovery finds that file.
+
+Verification:
+```
+bundle exec rspec spec/lib/pwn/plugins/{packet,capability_broker,sandbox}_spec.rb
+python3 spec/lib/pwn/plugins/capd_test.py
+python3 spec/lib/pwn/plugins/sandbox_test.py
+```
+
+Safe real Docker smoke after explicit provisioning:
+```
+bundle exec ruby -Ilib -rpwn/plugins/sandbox -e 'p PWN::Plugins::Sandbox.run(binary: "/bin/true")'
+```

data/documentation/Proxy-Skills-Hygiene.md

@@ -0,0 +1,102 @@
+# Native HTTP capture and skill hygiene
+
+## Native HTTP proxy (P16)
+
+`PWN::Plugins::MitmProxy` uses WEBrick's native proxy/CONNECT transport and
+Net::HTTP for interception. It does not require mitmproxy, Burp, or ZAP.
+Only backend `native` is accepted. HTTPS CONNECT tunnels work, but their
+contents are **not decrypted**: captured entries explicitly have
+`_capture: opaque_connect`. HTTP requests and responses are captured to HAR 1.2.
+
+```ruby
+require 'pwn/plugins/mitm_proxy'
+proxy = PWN::Plugins::MitmProxy.start(har_path: '/tmp/engagement.har')
+browser = PWN::Plugins::TransparentBrowser.open(
+  browser_type: :headless_chrome, capture_proxy: proxy
+)
+# Navigate the browser using its normal API. Chrome loopback bypass is disabled.
+entries = PWN::Plugins::MitmProxy.entries(proxy: proxy)
+entry = PWN::Plugins::MitmProxy.http_replay(
+  proxy: proxy, request_id: entries.first[:_request_id],
+  mutations: { method: 'POST', path: '/fixture', headers: { 'X-Test' => 'yes' }, body: 'sample' }
+)
+# Close the browser separately, then stop its caller-owned proxy:
+PWN::Plugins::MitmProxy.stop(proxy: proxy)
+```
+
+Agent toolset `http`: `http_proxy_start`, `http_proxy_entries`,
+`http_proxy_rules`, `http_replay`, `http_proxy_stop`. Lifecycle tools return
+JSON descriptors; subsequent calls use `proxy_id: descriptor[:id]`.
+The plugin also accepts `proxy:` descriptors. IDs are process-local, not
+persistent replay handles after restart.
+
+Replace the entire active rule list with `rules(proxy:, rules:)`. Rules are
+literal substitutions (not regex):
+
+```ruby
+[{ phase: 'request', field: 'header:x-test', match: 'old', replace: 'new' },
+ { phase: 'response', field: 'body', match: 'old', replace: 'new' }]
+```
+
+Fields are `body`, request-only `url`, or `header:NAME`. Replay mutations are
+`method`, `url`, `path`, `query`, `headers`, `body`; null header values remove
+headers. Hop-by-hop/framing headers are regenerated. Binary HAR bodies use
+base64 encoding. Replay does not mutate the original captured entry.
+
+HAR files contain **unredacted traffic**, including any cookies and credentials
+sent by the operator. They are created mode 0600; use engagement storage and
+retention controls. Only loopback fixtures are used by the regression tests.
+There is no built-in scope policy for proxy traffic; enforcement belongs in
+engagement network isolation or the central scope layer. Binding is loopback
+by default. Upstream HTTP timeout defaults to 30 seconds. Bodies and the
+session capture collection are currently buffered in memory, not streamed.
+
+## On-demand skills consolidation (P19)
+
+`PWN::AI::Agent::SkillConsolidation.consolidate(content:, evidence: {}, now:,
+stale_days: 90)` returns a pure proposal: `content`, `version`, `changed`,
+`deduplicated`, `promoted`, and `review`.
+
+- Deduplicates RL notes, ignoring leading date annotations and whitespace.
+- Conflicting text for one feedback ID, explicit negation against a SOP line,
+  regressed proofs, and stale verification move to a **not active SOP** review
+  section. Unmanaged SOP prose is never automatically deleted or rewritten.
+- Promotions require resolved status, three distinct explicitly successful
+  verification sessions, and recent non-future verification. Failure counts
+  and failure-session IDs do not count as successful evidence.
+- Managed promoted procedures are rechecked for stale or regressed proofs.
+- Stamps `<!-- pwn-skill-version: HASH12 updated: ISO8601 -->` after YAML
+  frontmatter; unchanged content remains byte-identical on subsequent passes.
+
+`consolidate_file(path:)` previews by default. Applying requires
+`dry_run: false, confirm: true, expected_sha256: preview[:source_sha256]`.
+It serializes cooperating consolidation writers, checks the original content,
+keeps a content-addressed backup, atomically replaces the file, and verifies
+readback. Symlink files are rejected. No weekly job is installed.
+
+Agent tool `skills_consolidate(name:, dry_run: true)` targets an already
+installed skill; it does not accept model-provided verification evidence.
+It reloads the skill index after an explicitly confirmed write.
+
+## Precise correction evidence (P20) and integration hooks
+
+Docker socket permissions, registry pull denial and template parsing remain
+distinct classes/signatures. Generic path fixes cannot resolve non-path
+failures; raw-socket fixes cannot resolve ordinary filesystem/daemon
+permissions. Legacy incompatible fixes are excluded from KNOWN FIXES.
+
+For promotion evidence, the successful verification hook should call:
+
+```ruby
+PWN::AI::Agent::Mistakes.note_hint_outcome(
+  signature: signature, helped: true, session_id: verified_session_id
+)
+```
+
+Failed hints clear that stability evidence. `skills_consolidate` consumes
+`verified_sessions` and `last_verified` keyed by the existing RL signature.
+The parent loop must pass `session_id` only after real verification; callers
+that omit it cannot promote notes merely by incrementing a counter.
+Session-recall/index consumers can read the `pwn-skill-version` stamp and
+prefer current installed content over historical SOP text. This module does
+not modify central loop or session-recall selection behavior.

data/documentation/Recon-Findings-API.md

@@ -0,0 +1,31 @@
+# Recon / Findings integration (P17 / P10)
+
+## Parent integration hooks
+
+- Existing autoloaded `PWN::Plugins::Recon` now exposes `run(opts)`; no new plugin autoload needed. New agent registration file: `lib/pwn/ai/agent/tools/recon_run.rb` (normal Registry discovery).
+- `finding_record` handler uses `PWN::Plugins::Findings.record_structured(opts)`. The loop can treat `ArgumentError` as incomplete finding input; **do not infer a working PoC from accepted input**. No Loop/config/CLI changes in this patch.
+- P3 hook: `Recon.run(..., ingest: true)` calls `PWN::AI::Context.ingest(path, session_id: engagement_id, **ingest_options)` after atomic persistence and JSON readback. `ingestor: callable` supports an alternate implementation with the same signature. Ingestion failure is returned in `result[:ingestion]` without discarding recon evidence. Preserve the literal asset ID in ingested chunks. Plugin callers opt in; the agent tool defaults ingestion on.
+
+## Recon model
+
+`Recon.run(target: '127.0.0.1', modules: %w[nmap banner tls], ports: [443], engagement_id: 'lab', ingest: true)`.
+
+Single hostname/IP target (no arbitrary CLI switches, URL, CIDR, or shell command), explicit integer ports, per-operation timeout 15 seconds by default (maximum 300). `nmap` uses an unprivileged TCP connect scan, without sudo or NSE. Existing `NmapIt` API remains untouched. `banner` passively reads up to 4096 bytes; it does not send an HTTP request. `tls` collects the certificate with `trust_verified: false` (not a trust audit). Optional `subfinder` and `nuclei` run **only if explicitly named**, and unavailable tools return module status rather than fabricate results. Nuclei observations are not automatically promoted to findings.
+
+Output: `{schema_version: 1, engagement_id:, assets: [{id:, address:, protocol:, port:, observations: [], evidence_paths: []}], modules: [], path:, ingestion: ...}`.
+
+Stored at `~/.pwn/engagements/<engagement>/recon/assets.json`; `root:` overrides the engagements directory for isolated fixtures. Raw scan evidence is persisted beside it. IDs are `asset-` plus the first 24 hex SHA256 characters of lowercase address, protocol, port joined by `|`. Repeated same-identity observations merge across runs, not overwrite other assets. DNS names and resolved IPs are distinct identities unless the source explicitly supplies the same address; the pipeline does not silently infer aliases.
+
+Use `affected_asset: asset[:id]` and `evidence_paths: asset[:evidence_paths]` in a structured finding. Stable IDs survive report generation and JSON ingestion unchanged.
+
+## Strict findings boundary and compatibility
+
+`record_structured` requires title, CWE identifier (`CWE-<positive integer>`), complete CVSS 3.0/3.1 base vector and matching numeric base score, affected_asset, nonempty existing readable absolute evidence_paths, nonempty PoC command/code string, attack_chain_refs array, remediation string, and numeric confidence 0..1. Chain refs must already exist in the same engagement. Invalid input raises before appending. CVSS 2/4, temporal/environmental vectors are explicitly unsupported (rejected, not normalized).
+
+Legacy `Findings.record`, query/report, chain, render, and SARIF output remain callable; legacy record is not the strict API. Agent record and chain operations are strict. Existing query/export tool operations remain available. Accepted structured rows mark `verification_status: not_executed`; evidence hashes prove captured bytes, not exploit execution. Severity is derived from the validated score. No automatic escalation for linked findings.
+
+Markdown/HTML/JSON report payloads compose connected explicit references into attack-chain sections, preserving all finding fields. Combined severity is maximum recorded constituent severity with a rationale explicitly disclaiming escalation and combined exploitability. This is not a computed CVSS chain score.
+
+## Verification boundaries
+
+Specs use disposable localhost TCP/TLS fixtures and real nmap connect scans. Optional external scanner outputs are parser fixtures, not internet engagements. Context hook failures are visible; embeddings are never synthesized. No remote scanning is necessary to run these focused specs.

data/documentation/Swarm.md

@@ -12,7 +12,7 @@ self-improvement loop covers the whole swarm.
 
 | Path | Contains |
 |---|---|
-| `~/.pwn/agents.yml` | Persona registry (name → role/engine/toolsets/max_iters) |
+| `~/.pwn/agents.yml` | Persona registry (name → role/engine/model/toolsets/max_iters) |
 | `~/.pwn/swarm/<id>/bus.jsonl` | Append-only chat every persona reads/writes |
 | `~/.pwn/swarm/<id>/personas.json` | persona name → `PWN::Sessions` id |
 
@@ -21,6 +21,41 @@ a `PWN::Cron` job) calling `Swarm.ask` with the same `swarm_id`.
 
 ## Define personas
 
+Each persona accepts optional `engine` and `model` keys. `model` is the exact
+provider model identifier (case and punctuation are preserved). Omit `engine`
+to inherit the active engine; omit `model` or leave it blank to use the selected
+provider's configured default model. Existing engine-only entries still work.
+
+For example, edit `~/.pwn/agents.yml`:
+
+```yaml
+reviewer:
+  role: Review implementation and tests.
+  engine: openai
+  model: gpt-6-astra
+  toolsets: [terminal, pwn]
+local_reviewer:
+  role: Independently review implementation and tests.
+  engine: ollama
+  model: your-installed-model:tag
+  toolsets: [terminal, pwn]
+```
+
+Replace model identifiers with models available to your configured providers.
+Personas can use different models on the same provider or different providers.
+The selection applies to `ask`, `debate`, and `broadcast`; overrides are scoped
+to each persona execution, restored after nested calls/errors, and do not rewrite
+global provider defaults. An omitted model uses the provider default, not an
+enclosing persona's model override. Provider authentication is unchanged.
+
+`agent_spawn` also accepts `model:` and `agent_list` reports it.
+
+On upgrade, `pwn setup --migrate` applies schema 3: existing persona entries
+without a `model` key receive an unset YAML `model:` field (null, meaning the
+selected provider's default). Existing model values, engine selections, and
+custom persona fields are preserved. Re-running migration makes no further
+changes. A missing `agents.yml` is not created by this migration.
+
 ```ruby
 agent_spawn(name: 'red_team',
             role: 'Offensive operator. Propose the most aggressive next step.',
@@ -82,8 +117,8 @@ agent_ask(name: 'red_team', swarm_id: tx[:swarm_id],
           request: 'blue_team raised WAF concerns - revise the payload.')
 ```
 
-Because each persona can pin a **different engine**, the debate is real model
-diversity, not one model role-playing.
+Each persona can pin a **different engine and/or model**, rather than requiring
+every persona to use one provider's default model.
 
 **See also:** [pwn-ai Agent](pwn-ai-Agent.md) ·
 [Agent Tool Registry](Agent-Tool-Registry.md) · [Sessions](Sessions.md)

data/etc/default_skills/pwn/ai/agent/engagement_memory/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: pwn-ai-agent
+description: Drive PWN::AI::Agent from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::Agent
+  source: pwn/ai/agent/engagement_memory.rb
+---
+
+# PWN::AI::Agent
+
+Public API for PWN::AI::Agent.
+
+## When to use
+
+Call `PWN::AI::Agent` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/agent/engagement_memory.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::Agent.help
+PWN::AI::Agent.help(opts)
+```
+
+## Public methods
+
+- `authors`
+- `help`
+
+## Source
+
+`pwn/ai/agent/engagement_memory.rb`
+
+## Verification
+
+`PWN::AI::Agent.respond_to?(:authors)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/agent/manifest/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: pwn-ai-agent-manifest
+description: Drive PWN::AI::Agent::Manifest from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::Agent::Manifest
+  source: pwn/ai/agent/manifest.rb
+---
+
+# PWN::AI::Agent::Manifest
+
+Trusted, on-disk tool declarations. Never load a manifest from tool args.
+
+## When to use
+
+Call `PWN::AI::Agent::Manifest` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/agent/manifest.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::Agent::Manifest.help
+PWN::AI::Agent::Manifest.load(opts)
+```
+
+## Public methods
+
+- `load`
+- `register`
+- `check`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/ai/agent/manifest.rb`
+
+## Verification
+
+`PWN::AI::Agent::Manifest.respond_to?(:load)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/agent/profiles/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: pwn-ai-agent
+description: Drive PWN::AI::Agent from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::Agent
+  source: pwn/ai/agent/profiles.rb
+---
+
+# PWN::AI::Agent
+
+Public API for PWN::AI::Agent.
+
+## When to use
+
+Call `PWN::AI::Agent` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/agent/profiles.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::Agent.help
+PWN::AI::Agent.help(opts)
+```
+
+## Public methods
+
+- `authors`
+- `help`
+
+## Source
+
+`pwn/ai/agent/profiles.rb`
+
+## Verification
+
+`PWN::AI::Agent.respond_to?(:authors)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/agent/request_runtime/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: pwn-ai-agent
+description: Drive PWN::AI::Agent from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::Agent
+  source: pwn/ai/agent/request_runtime.rb
+---
+
+# PWN::AI::Agent
+
+Public API for PWN::AI::Agent.
+
+## When to use
+
+Call `PWN::AI::Agent` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/agent/request_runtime.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::Agent.help
+PWN::AI::Agent.help(opts)
+```
+
+## Public methods
+
+- `authors`
+- `help`
+
+## Source
+
+`pwn/ai/agent/request_runtime.rb`
+
+## Verification
+
+`PWN::AI::Agent.respond_to?(:authors)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/agent/skill_consolidation/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: pwn-ai-agent-skillconsolidation
+description: Drive PWN::AI::Agent::SkillConsolidation from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::Agent::SkillConsolidation
+  source: pwn/ai/agent/skill_consolidation.rb
+---
+
+# PWN::AI::Agent::SkillConsolidation
+
+Conservative, deterministic SOP hygiene. Content proposals are pure; writes require an explicit path and optimistic-concurrency digest.
+
+## When to use
+
+Call `PWN::AI::Agent::SkillConsolidation` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/agent/skill_consolidation.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::Agent::SkillConsolidation.help
+PWN::AI::Agent::SkillConsolidation.consolidate(opts)
+```
+
+## Public methods
+
+- `consolidate`
+- `consolidate_file`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/ai/agent/skill_consolidation.rb`
+
+## Verification
+
+`PWN::AI::Agent::SkillConsolidation.respond_to?(:consolidate)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/agent/tool_guard/SKILL.md

@@ -28,11 +28,12 @@ Class methods take `(opts = {})` and read `opts`.
 
 ```ruby
 PWN::AI::Agent::ToolGuard.help
-PWN::AI::Agent::ToolGuard.present(opts)
+PWN::AI::Agent::ToolGuard.unwrap_payload(opts)
 ```
 
 ## Public methods
 
+- `unwrap_payload`
 - `present`
 - `placeholder`
 - `bashism`
@@ -91,5 +92,5 @@ PWN::AI::Agent::ToolGuard.present(opts)
 
 ## Verification
 
-`PWN::AI::Agent::ToolGuard.respond_to?(:present)` after the
+`PWN::AI::Agent::ToolGuard.respond_to?(:unwrap_payload)` after the
 module is loaded. Read the source for parameter names.