pwn 0.5.739 → 0.5.740

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5a7b0a41aca20dc31343279c213c042d7362ff5c0ac59a89150a427111d5b11d
-  data.tar.gz: b4335ec85624abed2dbb25d8941ab1db79d73b07fb8b4eca64b90f56a96d15f7
+  metadata.gz: 4abf337af5fb9173890e87ee2d6d8523f93f62c6d9453d1fec9431f650f04a3e
+  data.tar.gz: 2639a24b9b3b1895e392b8168a604270b9f43118c743919c7b8348ec8f4dd929
 SHA512:
-  metadata.gz: 226c64efa942d21212d5766604c299908118f1be000093204ff1e70b31359d2931e009df8cdc0894696832240d597b687397975fad7437eea288a0254236b6d6
-  data.tar.gz: e2ed95fb25177d41d49cfe3efaef6cb162066eba28a7470d3256c88b74e6e8779b4daf2204836051305a8f7ec20d478fdd82526df046a13bd88eae4bbd68765c
+  metadata.gz: e383699557934dab9374bef09204e3e37c0e4b255a3dd3c13ef1597c265fd46b7b71bb79dd8094d2fb42aea71512e01b5a7bce9eae08a3f74d8dfb7639f8ff00
+  data.tar.gz: 6f1aea7cd79a34738923014fbc13024797c614c33e28058ab8b565402f665ccb464aa440c148291a385f4ad6b2617412d42b3c526df5d2f6cdff349149872c9d

data/Gemfile

@@ -50,7 +50,7 @@ gem 'libusb', '0.8.0'
 gem 'luhn', '3.0.0'
 gem 'mail', '2.9.1'
 gem 'mcp', '1.5.1'
-gem 'meshtastic', '0.0.183'
+gem 'meshtastic', '0.0.184'
 gem 'metasm', '1.0.6'
 gem 'mongo', '2.26.0'
 gem 'msfrpc-client', '1.1.2'

data/documentation/Agent-Tool-Registry.md

@@ -6,17 +6,17 @@ toolsets; the JSON-Schema for each tool is what the model actually sees.
 
 ![Tool registry](diagrams/agent-tool-registry.svg)
 
-## Toolsets to tools  (13 toolsets · 88 tools)
+## Toolsets to tools  (16 toolsets · 150 tools)
 
 | Toolset | Tools | Backed by |
 |---|---|---|
 | `http` | `http_proxy_start` · `http_proxy_stop` · `http_proxy_entries` · `http_proxy_rules` · `http_replay` | `PWN::Plugins::MitmProxy`: native HTTP HAR capture/replay; opaque CONNECT tunnels |
-| `terminal` | `shell` | `Open3.capture3` on the host, after `PWN::AI::Agent::ToolGuard` |
-| `pwn` | `pwn_eval` · `sbom_scan` | `TOPLEVEL_BINDING.eval` in the live REPL process, after `ToolGuard`; SBOM engines via `PWN::Plugins::SBOM` |
+| `terminal` | `shell` · `job_run` · `job_status` · `job_tail` · `job_result` · `job_kill` | Foreground host commands plus `PWN::Plugins::Jobs` durable supervisors |
+| `pwn` | `pwn_eval` · `sbom_scan` · `r2_functions` · `r2_disasm` · `gdb_run_to_crash` · `nmap_scan` · `nuclei_scan` · `browser_goto` · `loot_query` | `TOPLEVEL_BINDING.eval` in the live REPL process, after `ToolGuard`; SBOM engines via `PWN::Plugins::SBOM`; r2pipe JSON via `PWN::Plugins::Radare2`; gdb MI3 crash reports via `PWN::Plugins::GDBMI`; nmap XML ingest/diff via `PWN::Plugins::NmapIt`; nuclei/httpx JSONL findings via `PWN::Plugins::Nuclei`; TransparentBrowser navigation captures screenshot/DOM/HAR via `browser_goto`; engagement loot via `PWN::Plugins::Vault` |
 | `mcp` | `mcp` | `PWN::AI::MCP` session broker → any `PWN::AI::MCP::*` stdio client |
 | `memory` | `memory_remember` · `memory_recall` · `memory_forget` · `memory_clear` · **`memory_lean`** | `PWN::Memory` → `~/.pwn/memory.json` |
 | `skills` | `skills_consolidate` · **`skills_recall`** · `skill_list` · `skill_view` · `skill_create` · `skill_add_reference` · `skill_delete` · `skill_migrate_legacy` | `~/.pwn/skills/<name>/SKILL.md` (**[agentskills.io](https://agentskills.io) spec**; legacy flat `*.md` auto-migrated) |
-| `sessions` | **`session_recall`** · `sessions_list` · `sessions_view` · `sessions_current` · `sessions_delete` · `sessions_stats` · **`sessions_lean`** | `PWN::Sessions` → `~/.pwn/sessions/` |
+| `sessions` | **`session_recall`** · `sessions_list` · `sessions_view` · `sessions_current` · `sessions_delete` · `sessions_stats` · **`sessions_lean`** · `artifact_read` · `artifact_grep` · `artifacts_list` · `artifacts_get` · `artifact_put` · `artifact_get` | `PWN::Sessions` → `~/.pwn/sessions/`; `PWN::Plugins::ArtifactRegistry` → `~/.pwn/artifacts/` |
 | `learning` | `learning_note_outcome` · `learning_reflect` · `learning_distill_skill` · `learning_stats` · `learning_outcomes` · `learning_consolidate` · `learning_reset` · `learning_auto_introspect_toggle` · **`learning_gc_stores`** · **`learning_purge_noise`** · **`mistakes_list`** · **`mistakes_record`** · **`mistakes_resolve`** · **`mistakes_reset`** · **`mistakes_lean`** · **`reward_judge`** · **`reward_prm`** · **`reward_sentinel`** · **`reward_preferences`** · **`reward_export_dpo`** · **`reward_warm_sentinel`** · **`reward_scrub_preferences`** · **`reward_preference_balance`** · **`curriculum_practice`** · **`curriculum_train`** · **`curriculum_hindsight`** · **`curriculum_offline_judge`** · **`curriculum_preference_balance`** | `PWN::AI::Agent::Learning` + `Mistakes` + `Reward` + `Curriculum` → `~/.pwn/learning.jsonl` + `~/.pwn/mistakes.json` + `~/.pwn/preferences.jsonl` + `~/.pwn/curriculum/` + `~/.pwn/finetune/` |
 | `reward` | **`reward_generator_mix`** | `PWN::AI::Agent::Reward.generator_mix` → online preference source-mix controller (`preferences.jsonl`) |
 | `curriculum` | **`curriculum_practice_kpi`** | `PWN::AI::Agent::Curriculum.practice_kpi` → `~/.pwn/curriculum_kpi.jsonl` |
@@ -74,6 +74,8 @@ pool to:
 CORE_TOOLS / DEFAULT_PREFERENCE (same list):
 memory_recall · session_recall · skills_recall · pwn_eval · shell
 mistakes_record · mistakes_resolve · learning_note_outcome · memory_remember · skills_update
+artifact_read · artifact_grep
+job_run · job_status · job_tail · job_result · job_kill
             + top-K keyword-ranked matches for THIS request
               (ties break on Metrics per-engine success_rate, then
                ai.agent.tool_preference)
@@ -83,13 +85,121 @@ mistakes_record · mistakes_resolve · learning_note_outcome · memory_remember
 PWN::AI::Agent::Registry.definitions(relevance: 'nmap sweep 10.0.0.0/8', top_k: 10)
 PWN::AI::Agent::Registry.rank(query: 'run a shell command')   # inspect ranking
 PWN::AI::Agent::Registry.preference_order                     # Env / DEFAULT_PREFERENCE
-PWN::AI::Agent::Registry.toolsets                              # -> the 13 names above
-PWN::AI::Agent::Registry.all.count                             # -> 88
+PWN::AI::Agent::Registry.toolsets                              # -> the 16 names above
+PWN::AI::Agent::Registry.all.count                             # -> 146 (after discover)
 ```
 
 Frontier engines leave `tool_router` off (unless you set it) and receive the
 full set. Local engines (`ollama` / `openwebui`) default `tool_router` to on.
 
+## Durable long-running jobs
+
+Use `job_run(command:, max_runtime:, cwd:, env:, idempotency_key:)` for fuzzers,
+full scans, and Ghidra headless analysis. It returns a job ID rather than holding
+a tool call open. A separate Ruby supervisor owns the workload, persists status
+and logs under `~/.pwn/jobs`, and remains alive when the launching agent exits.
+`max_runtime: 21600` permits six hours; `0` means no runtime limit. The supervisor
+enforces that deadline without requiring polls. This runtime does not enter
+Dispatch's foreground timeout budget or its +180-second retry ladder.
+
+Poll `job_status(id:)` for state and exit/signal. Read `job_tail(id:, offset: 0)`
+and carry its `next_offset` into the next read; log pages are capped to the inline
+budget. Log `eof` is only the current end of the log, not task completion.
+Call `job_status` without an ID to rediscover recent jobs after changing sessions.
+Use a stable `idempotency_key` for launch retries; do not rerun the command to poll
+it. `job_kill` requests cancellation; confirm the terminal status afterward.
+These job tools are in the default core set, subject to toolset exclusions.
+
+`job_run(jobs: [...])` also runs its job graph inside a detached supervisor.
+`shell(background: true, max_runtime: ...)` provides the same detached lifecycle;
+the runtime predictor can route long shell work before Dispatch injects a timeout.
+`fuzz_campaign(action: start, ...)` forwards runtime, working directory, environment,
+session and idempotency settings to the same supervisor. No named-binary regex
+is required for these routes. Host reboot/process-manager cgroup termination is
+not session persistence: workloads are not automatically restarted after those
+events, and lost supervision must not be reported as successful completion.
+
+## Lossless tool-result paging
+
+Oversized handler results are saved before redaction/quarantine to
+`~/.pwn/artifacts/<session>/<sha8>.bin`. The inline summary carries the handle,
+full SHA-256, byte count, serialization type, bounded preview, and execution
+status (including nonzero exits/timeouts). Raw string results retain every byte;
+structured results use JSON, with base64 wrappers for non-UTF-8 strings.
+Files are private (0600, directories 0700). A short-hash collision fails rather
+than overwriting different bytes. Spill errors are explicit tool failures.
+
+`PWN::Env[:ai][:agent][:artifact_max_tokens]` optionally sets N. Without a
+provider tokenizer, a byte is treated as a conservative token upper bound:
+spill may happen early, never on the assumption that arbitrary dumps average
+four bytes per token. The default is 6000 (local engines: 1024), with a minimum
+of 1024 to leave room for the handle/metadata. Existing `result_max` and per-tool
+caps can lower the default. This is a runtime fallback; existing config files
+are not rewritten.
+
+`artifact_read(handle, offset, length)` uses byte offsets, clamps page length
+to the inline budget, and returns `next_offset`/`eof`. Handle pages default to
+base64 for exact reconstruction; request `mode: text` for inspection. Legacy
+path/ref readers remain available. `artifact_grep(handle, regex, offset)` returns
+bounded per-line search results with byte offsets and a continuation cursor.
+Regexes match whole binary lines (first match per line), not page fragments;
+lines over 64 MiB raise an explicit error directing the model to `artifact_read`.
+Regex execution is time-limited. Both readers
+are core tools (subject to explicit toolset exclusions). Follow cursors rather
+than assuming the requested length was returned. The loop keeps only its bounded
+recent tool history; paging does not accumulate the full dump in context.
+Credential redaction still applies to inline views; the saved bytes are unchanged.
+
+## Payload validation diagnostics
+
+`invalid_payload` responses include `rule_id`, `match`, `offset`, and `remedy`.
+For rejected shell placeholders and syntax, `match` is the actual rejected
+substring and `offset` is its zero-based byte position in the original decoded
+command, including UTF-8 and base64 input. The legacy `offending_token`,
+`byte_range` (exclusive end), `hint`, and `suggestion` fields remain available.
+Missing fields and schema constraints have no command-text offset (`null`);
+schema denials also identify the argument using `data_pointer`.
+
+Ellipses in literal data pass without an escape hatch: Ruby is tokenized with
+Ripper, and shell words are scanned with quote/escape state and queued heredoc
+delimiters (including `<<-` tab stripping). Ruby strings, percent literals and
+heredocs are data; parsed ranges and argument forwarding are valid code.
+Bare elided commands and incomplete Ruby stubs such as `def foo(<3dots>)` are
+denied with the same diagnostics. Explicit `placeholder_ok: true` still skips
+the placeholder check, but never bypasses Ruby parsing or shell execution.
+For quoting/transport, use `encoding: "base64"` and the encoded command in `data`.
+Base64 is decoded before validation and is not a bypass: preserve the explicit
+placeholder opt-in when needed. Neither option overrides shell syntax, size,
+or policy restrictions. Each denial's `remedy` names the applicable correction.
+
+## Required artifact contract
+
+At intent classification, `Loop.run` precommits explicit output destinations as
+an immutable `required_artifacts` list. Relative paths resolve against the
+initial working directory; input/read paths are not output obligations. The
+same list drives the prompt checklist, dispatch snapshots and final-answer gate.
+Artifact-bearing requests cannot take greeting/how-to/recall text-only shortcuts.
+
+A successful write-effect call must change the destination's host snapshot.
+The host then records stat and SHA-256 readback in internal tool-message metadata,
+bound to this turn's contract ID. Finalization rechecks the current file against
+that evidence. Textual delivery claims, mere existence, old-turn observations,
+and files changed after readback cannot satisfy the gate. A proven current-turn
+write delta takes precedence over filesystem timestamp clock-tick lag.
+Nested calls inherit the contract and restore it on return. Historical mistake
+entries are not deleted by this enforcement.
+
+## Retry checkpoints
+
+The identical-payload checkpoint distinguishes retries from successful repeats.
+A structured nonzero exit or timeout resets that payload's repeat count and
+does not extinguish the payload through the repeated-failure guard. The command
+can therefore be retried verbatim; timeout retries still use Dispatch's existing
+deadline escalation and cumulative budget. Successful repeats retain the
+checkpoint. Policy denials, exhausted budgets, checkpoint responses, and text
+in stdout do not grant an execution-failure exemption. Actual command failures
+remain recorded; the exemption does not erase historical mistake entries.
+
 ## Tool preference (`ai.agent.tool_preference`)
 
 When keyword fit and other rank scores tie, the registry prefers this
@@ -98,6 +208,8 @@ default order:
 ```text
 memory_recall · session_recall · skills_recall · pwn_eval · shell
 mistakes_record · mistakes_resolve · learning_note_outcome · memory_remember · skills_update
+artifact_read · artifact_grep
+job_run · job_status · job_tail · job_result · job_kill
 ```
 
 Set `ai.agent.tool_preference` in `~/.pwn/pwn.yaml`, or pass `order:` /
@@ -113,6 +225,51 @@ stable sort after the router slims the pool.
 
 `Policy` uses the same list when it suggests a next action in the prompt.
 
+## Finding evidence and reproducible reports
+
+`finding_record` requires a command/code `poc`, ordered `reproduction_steps`
+(setup, commands, expected observations), and an evidence-based
+`severity_justification`, alongside its CVSS/CWE/asset/remediation fields.
+Provide `evidence_paths` or `artifact_handles` (or both). Each handle is either
+a string or an object containing `handle`, optional `kind` (`pcap`, `screenshot`,
+`crash`, `poc`, `evidence`), optional display `label`, and optional expected
+full `sha256`. Use artifact middleware handles such as `session/sha8.bin`,
+`sha256:<64 lowercase hex digits>`, or the legacy bare full SHA-256 returned
+by `ArtifactRegistry.put`. Handles are validated, not treated as file paths.
+
+The host resolves each handle, computes the full SHA-256 and byte count, checks
+any supplied digest, and preserves an engagement-owned copy. The persisted
+finding includes `evidence_artifacts` with handle, kind, label, source `path`,
+durable `stored` path, hash, and size. Malformed, missing, symlinked or tampered
+handles fail recording. Verification/retest and combined-impact evidence are
+also attached to the finding; previous evidence snapshots remain linked.
+
+Export with `finding_record(op: 'export', engagement_id: 'fixture',
+dir_path: '/tmp/findings-report', report_name: 'findings')`. Generated reports
+include the supplied PoC instructions and justification with evidence hashes
+per finding. HTML/Markdown include portable links, raster screenshots, and
+escaped PoC previews; JSON/SARIF retain structured linkage. Distribute the
+adjacent `attachments/` directory with the reports. Every attachment is checked
+against its recorded digest and size; missing or changed durable copies and
+tampered export targets fail explicitly. Active SVG/HTML is never embedded as
+a screenshot. Full PoC text is downloadable even when its preview is bounded.
+Evidence packaging currently reads one full attachment into memory at a time.
+Hashes establish byte identity, not successful exploitation;
+new records remain `not_executed` until explicitly verified. Direct legacy
+`Findings.record_structured` callers may omit the new narrative fields (the
+existing PoC becomes their reproduction step), but the agent tool requires
+them. Original-source removal/tampering remains detectable by
+`Findings.evidence_verify`; durable copies are checked too.
+
+Findings can declare outgoing `enables: [finding_id]` links. Use
+`finding_record(op: 'link', id: source_id, enables: [target_id])` to link
+already recorded findings. `chain_impact` takes ordered source-to-impact
+`ids`, combined-impact evidence, a severity justification, and reproduction
+steps. Reports rank the resulting paths by their scoped combined-impact
+assessment; linked constituents remain in technical details rather than
+appearing as separate summary priorities. See
+[Recon / Findings API](Recon-Findings-API.md#directed-attack-paths-and-combined-impact).
+
 ## Adding a tool
 
 ```ruby

data/documentation/Diagrams.md

@@ -68,7 +68,7 @@ groups) so lines never criss-cross.
 [source](diagrams/dot/ai-integration-tool-calling.dot) · doc: [AI Integration](AI-Integration.md)
 ![ai-integration-tool-calling](diagrams/ai-integration-tool-calling.svg)
 
-### Agent Tool Registry (13 toolsets · 88 tools)
+### Agent Tool Registry (16 toolsets · 150 tools)
 [source](diagrams/dot/agent-tool-registry.dot) · doc: [Agent Tool Registry](Agent-Tool-Registry.md)
 ![agent-tool-registry](diagrams/agent-tool-registry.svg)
 

data/documentation/Home.md

@@ -36,7 +36,7 @@
 | | |
 |---|---|
 | [AI / LLM Integration](AI-Integration.md) | OpenAI · Anthropic · Grok (OAuth) · Gemini · Ollama · Open WebUI |
-| [Agent Tool Registry](Agent-Tool-Registry.md) | 13 toolsets · **87** LLM-callable tools |
+| [Agent Tool Registry](Agent-Tool-Registry.md) | 16 toolsets · **150** LLM-callable tools |
 | [Memory · Skills · Learning](Skills-Memory-Learning.md) | Introspection - self-improvement loop + 10 bundled skills on first launch |
 | [Mistakes](Mistakes.md) | **Negative feedback** - fingerprint failures · do-NOT-repeat · `[REPEATING]`/`[REGRESSED]` · inline self-correction |
 | [Reinforcement Learning](Reinforcement-Learning.md) | **`Reward` + `Curriculum` + `Policy`** - outcome/process judges · preference ledger · self-play practice · live Q / REINFORCE (advisory) · export-ready LoRA gate |

data/documentation/How-PWN-Works.md

@@ -29,7 +29,7 @@ hardware).
 |---|---|
 | `Loop` | plan → **TaskSummarizer** briefs → dispatch tool_calls → observe → repeat until `may_finalize?`. No iteration-budget abort |
 | **`TaskSummarizer`** | Executive UX: every request gets an English task compass (`emit_plan!` · `about_to` as `task k/n`) - no statement/question/goal type |
-| `Registry` | JSON-Schema function definitions grouped into 13 **toolsets** · **88 tools** · `CORE_TOOLS` = `DEFAULT_PREFERENCE` (`memory_recall` · `session_recall` · `skills_recall` · `pwn_eval` · `shell` · `mistakes_record` · `mistakes_resolve` · `learning_note_outcome` · `memory_remember`) |
+| `Registry` | JSON-Schema function definitions grouped into 16 **toolsets** · **150 tools** · `CORE_TOOLS` = `DEFAULT_PREFERENCE` (`memory_recall` · `session_recall` · `skills_recall` · `pwn_eval` · `shell` · `mistakes_record` · `mistakes_resolve` · `learning_note_outcome` · `memory_remember` · `skills_update` · `artifact_read` · `artifact_grep`) |
 | `Dispatch` / `Result` | execute a tool, capture stdout/value/error/duration |
 | `PromptBuilder` | inject MEMORY / SKILLS / LEARNING / **KNOWN MISTAKES + FIXES** / METRICS / **POLICY** / EXTROSPECTION / RECENT TURNS |
 | `Metrics` · `Learning` · `Reflect` · **`Policy`** | **introspection** - how well am I doing? (Policy is live Q / REINFORCE, advisory rank only) |

data/documentation/Plugin-Degradation.md

@@ -15,6 +15,10 @@ Required: `gdb`. Fallback: `PWN::Plugins::Debugger` still exposes `cyclic` helpe
 
 Required: `nuclei`. Fallback: `TransparentBrowser` + `pwn_eval`.
 
+## pwn-plugins-httpx
+
+Required: `httpx`. Fallback: `TransparentBrowser` + `NmapIt.scan`.
+
 ## pwn-plugins-sqlmap
 
 Required: `sqlmap`. Fallback: `pwn_eval` HTTP clients.
@@ -41,11 +45,11 @@ Required: `msfconsole`. Fallback: `exploitdev`, `pwn_eval`, `PWN::Plugins::Handl
 
 ## pwn-plugins-burpsuite
 
-Required: `burpsuite`. Fallback: `TransparentBrowser`, `nuclei`, `PWN::Plugins::MitmProxy`.
+Required: `burpsuite`. Fallback: `TransparentBrowser`, `nuclei`, `httpx`, `PWN::Plugins::MitmProxy`.
 
 ## pwn-plugins-zaproxy
 
-Required: `zaproxy`. Fallback: `nuclei`, `TransparentBrowser`, `PWN::Plugins::MitmProxy`.
+Required: `zaproxy`. Fallback: `nuclei`, `httpx`, `TransparentBrowser`, `PWN::Plugins::MitmProxy`.
 
 ## pwn-plugins-packet
 

data/documentation/Recon-Findings-API.md

@@ -28,7 +28,39 @@ Legacy `Findings.record`, query/report, chain, render, and SARIF output remain c
 
 `PWN::AI::Agent::Swarm.ensure_specialists` / `agent_roster` writes recon, authz, injection, xss, and business_logic personas. SARIF export is `Findings.render`; `PWN::Plugins::Github.open_fix_pr` opens a remediation PR (tests stub the GitHub API).
 
-Markdown/HTML/JSON report payloads compose connected explicit references into attack-chain sections, preserving all finding fields. Combined severity is maximum recorded constituent severity with a rationale explicitly disclaiming escalation and combined exploitability. This is not a computed CVSS chain score.
+## Directed attack paths and combined impact
+
+`enables: [finding_id]` is an outgoing edge: this finding enables the named
+finding. Targets must already exist in the same engagement. For findings
+recorded earlier, use `finding_record(op: 'link', id: ssrf_id,
+enables: [admin_id])` or `Findings.link(id: ssrf_id, enables: [admin_id])`.
+The update replaces outgoing `enables` links; legacy `attack_chain_refs` are
+incoming prerequisites and remain supported. Missing IDs, duplicate edges,
+self-links, cross-engagement links, and cycles are rejected.
+
+Record the demonstrated combined impact with ordered source-to-impact `ids`:
+`finding_record(op: 'chain_impact', ids: [ssrf_id, admin_id],
+combined_impact_path: '/tmp/combined-impact.txt', escalate: true,
+combined_severity: 'critical', severity_justification: justification,
+reproduction_steps: steps)`. The evidence file must name each ID and describe
+the combined impact; keep actual PoC output with it. This preserves a scoped
+`chain_assessments` entry containing the ordered IDs, justification, steps,
+and durable evidence hashes. Different paths retain separate assessments.
+
+Reports enumerate directed root-to-leaf paths and rank them by the assessed
+combined severity, not by summing or averaging constituent CVSS. An evidenced
+SSRF → internal-admin takeover can therefore be one critical priority while
+both constituent findings retain their medium CVSS in technical details.
+HTML/Markdown display ranked paths before details; JSON includes `priorities`
+and `attack_chains`; SARIF emits one result per path plus standalone findings.
+Chain evidence is exported beside the report and verified against its hash.
+
+An assessment applies only to its exact ordered path. Linking alone never
+creates a critical rating: unassessed paths retain maximum constituent
+severity and are explicitly marked `unassessed`. Severity is an evidence-based
+assessment, not an automatically calculated chain CVSS score. The report
+rejects invalid cyclic graphs and more than 1000 reportable paths rather than
+silently dropping paths. Hash checks prove byte identity, not exploit execution.
 
 ## Verification boundaries
 

data/documentation/What-is-PWN.md

@@ -20,7 +20,7 @@ with a **tool-calling AI agent** on top that can run the same methods.
 | `PWN::FFI::*` | **8** | Native DSP/RF backends: Volk · Liquid · FFTW · RTLSdr · HackRF · AdalmPluto · SoapySDR · Stdio |
 | `PWN::AI::*` | **6** engines | OpenAI, Anthropic, Grok (OAuth device-flow), Gemini, Ollama, Open WebUI |
 | `bin/pwn_*` + `pwn` | **54** | Headless CLI executables for CI/CD |
-| Agent toolsets | **13** · **88 tools** | terminal · pwn · memory · skills · sessions · learning · metrics · policy · extrospection · cron · swarm · reward · curriculum |
+| Agent toolsets | **16** · **150 tools** | terminal · pwn · memory · skills · sessions · learning · metrics · policy · extrospection · cron · swarm · reward · curriculum · http · mcp · manifest |
 
 ## Three ways to use it
 

data/documentation/pwn-ai-Agent.md

@@ -101,7 +101,7 @@ $ pwn --ai "run bin/pwn_sast against ./src and push findings to DefectDojo"
 
 ## What the agent can call
 
-13 toolsets · **88 tools** - full table at
+16 toolsets · **150 tools** - full table at
 [Agent Tool Registry](Agent-Tool-Registry.md).
 
 The two that matter most:

data/etc/default_skills/pwn/ai/agent/confirmation/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: pwn-ai-agent-confirmation
+description: Drive PWN::AI::Agent::Confirmation from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::Agent::Confirmation
+  source: pwn/ai/agent/confirmation.rb
+---
+
+# PWN::AI::Agent::Confirmation
+
+Per-engagement ACK for exploit/destructive tool calls (PWN-AI-005 tiers).
+
+## When to use
+
+Call `PWN::AI::Agent::Confirmation` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/agent/confirmation.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::Agent::Confirmation.help
+PWN::AI::Agent::Confirmation.required_bins(opts)
+```
+
+## Public methods
+
+- `required_bins`
+- `tier`
+- `gate`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/ai/agent/confirmation.rb`
+
+## Verification
+
+`PWN::AI::Agent::Confirmation.respond_to?(:required_bins)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/agent/result/SKILL.md

@@ -12,7 +12,7 @@ metadata:
 
 # PWN::AI::Agent::Result
 
-Conditioning applied to every tool result before it re-enters the conversation as a role:'tool' message: hard size cap + credential redaction. Keeps the context window bounded and avoids leaking PWN::Env credentials back into the model.
+Conditioning applied to every tool result before it re-enters the conversation as a role:'tool' message: lossless paging + credential redaction. Keeps the context window bounded and avoids leaking PWN::Env credentials back into the model.
 
 ## When to use
 
@@ -34,6 +34,9 @@ PWN::AI::Agent::Result.condition(opts)
 ## Public methods
 
 - `condition`
+- `page`
+- `token_limit`
+- `page_length`
 - `default_max`
 - `redact`
 - `authors`

data/etc/default_skills/pwn/ai/agent/task_dag/SKILL.md

@@ -0,0 +1,50 @@
+---
+name: pwn-ai-agent-taskdag
+description: Drive PWN::AI::Agent::TaskDAG from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::Agent::TaskDAG
+  source: pwn/ai/agent/task_dag.rb
+---
+
+# PWN::AI::Agent::TaskDAG
+
+Planner/executor split: YAML task DAGs with per-step checkpoints.
+
+## When to use
+
+Call `PWN::AI::Agent::TaskDAG` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/agent/task_dag.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::Agent::TaskDAG.help
+PWN::AI::Agent::TaskDAG.required_bins(opts)
+```
+
+## Public methods
+
+- `required_bins`
+- `plan`
+- `execute`
+- `resume`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/ai/agent/task_dag.rb`
+
+## Verification
+
+`PWN::AI::Agent::TaskDAG.respond_to?(:required_bins)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/agent/tool_guard/SKILL.md

@@ -36,7 +36,9 @@ PWN::AI::Agent::ToolGuard.unwrap_payload(opts)
 - `unwrap_payload`
 - `present`
 - `placeholder`
+- `placeholder_match`
 - `bashism`
+- `bashism_match`
 - `shell_syntax_surface`
 - `mint_canary`
 - `canary_leak`

data/etc/default_skills/pwn/ai/agent/tools/browser_goto/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: pwn-ai-agent-tools-browsergoto
+description: Drive PWN::Ai::Agent::Tools::BrowserGoto from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Ai::Agent::Tools::BrowserGoto
+  source: pwn/ai/agent/tools/browser_goto.rb
+---
+
+# PWN::Ai::Agent::Tools::BrowserGoto
+
+Public API for PWN::Ai::Agent::Tools::BrowserGoto.
+
+## When to use
+
+Call `PWN::Ai::Agent::Tools::BrowserGoto` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/agent/tools/browser_goto.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Ai::Agent::Tools::BrowserGoto.help
+PWN::Ai::Agent::Tools::BrowserGoto.help(opts)
+```
+
+## Public methods
+
+- _(no public class methods parsed)_
+
+## Source
+
+`pwn/ai/agent/tools/browser_goto.rb`
+
+## Verification
+
+`PWN::Ai::Agent::Tools::BrowserGoto.respond_to?(:help)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/agent/tools/loot_query/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: pwn-ai-agent-tools-lootquery
+description: Drive PWN::Ai::Agent::Tools::LootQuery from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Ai::Agent::Tools::LootQuery
+  source: pwn/ai/agent/tools/loot_query.rb
+---
+
+# PWN::Ai::Agent::Tools::LootQuery
+
+Public API for PWN::Ai::Agent::Tools::LootQuery.
+
+## When to use
+
+Call `PWN::Ai::Agent::Tools::LootQuery` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/agent/tools/loot_query.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Ai::Agent::Tools::LootQuery.help
+PWN::Ai::Agent::Tools::LootQuery.help(opts)
+```
+
+## Public methods
+
+- _(no public class methods parsed)_
+
+## Source
+
+`pwn/ai/agent/tools/loot_query.rb`
+
+## Verification
+
+`PWN::Ai::Agent::Tools::LootQuery.respond_to?(:help)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/agent/tools/nmap_scan/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: pwn-ai-agent-tools-nmapscan
+description: Drive PWN::Ai::Agent::Tools::NmapScan from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Ai::Agent::Tools::NmapScan
+  source: pwn/ai/agent/tools/nmap_scan.rb
+---
+
+# PWN::Ai::Agent::Tools::NmapScan
+
+Public API for PWN::Ai::Agent::Tools::NmapScan.
+
+## When to use
+
+Call `PWN::Ai::Agent::Tools::NmapScan` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/agent/tools/nmap_scan.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Ai::Agent::Tools::NmapScan.help
+PWN::Ai::Agent::Tools::NmapScan.help(opts)
+```
+
+## Public methods
+
+- _(no public class methods parsed)_
+
+## Source
+
+`pwn/ai/agent/tools/nmap_scan.rb`
+
+## Verification
+
+`PWN::Ai::Agent::Tools::NmapScan.respond_to?(:help)` after the
+module is loaded. Read the source for parameter names.