@dzhechkov/p-replicator 1.5.8 → 1.5.12

package/templates/.claude/skills/goap-research-ed25519/scripts/goap_planner.py

@@ -3,7 +3,7 @@
 GOAP Research Planner with Ed25519 Verification
 
 Enhanced Goal-Oriented Action Planning for research tasks with
-cryptographic verification support for anti-hallucination protection.
+cryptographic provenance and tamper-evidence support.
 
 Features:
 - A* search for optimal research paths
@@ -383,8 +383,8 @@ def find_research_plan(
         if goal_state.issubset(current_state):
             # Check if verification requirements are met
             if require_verification and current.unsigned_claims > 0:
-                # In strict/paranoid mode, penalize but don't reject
-                pass
+                # In strict/paranoid mode, unsigned or invalid claims are rejected.
+                continue
             
             # Reconstruct state progression
             states = [initial_state]
@@ -396,7 +396,7 @@ def find_research_plan(
             
             # Calculate confidence based on verification
             base_confidence = 1.0 - (current.unsigned_claims * 0.1)
-            estimated_confidence = max(0.5, min(1.0, base_confidence))
+            estimated_confidence = min(1.0, base_confidence)
             
             return ResearchPlan(
                 actions=current.actions,

package/templates/.claude/skills/goap-research-ed25519/scripts/test_ed25519_verifier.py

@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+"""Load-bearing security tests for ed25519_verifier.py."""
+
+import copy
+import unittest
+
+import ed25519_verifier as ev
+
+
+@unittest.skipIf(ev.CRYPTO_BACKEND is None, "No Ed25519 backend installed")
+class Ed25519VerifierSecurityTests(unittest.TestCase):
+    def make_pinned_pair(self):
+        signer = ev.Ed25519Verifier(auto_generate_keypair=True)
+        verifier = ev.Ed25519Verifier(
+            trusted_issuers={
+                "nature.com": {
+                    "pubkey_b64": signer.get_public_key_b64(),
+                    "status": "active",
+                }
+            }
+        )
+        return signer, verifier
+
+    def test_attacker_self_signed_trusted_string_rejected(self):
+        _, verifier = self.make_pinned_pair()
+        attacker = ev.Ed25519Verifier(auto_generate_keypair=True)
+
+        fact = attacker.create_issuer_signed_fact(
+            claim="Fabricated result was published",
+            source_url="https://nature.com/articles/example",
+            source_content="attacker-controlled content",
+            issuer="nature.com",
+        )
+
+        result = verifier.verify_fact(fact)
+
+        self.assertFalse(result.verified)
+        self.assertEqual(result.confidence, 0.0)
+        self.assertNotEqual(result.confidence, 0.95)
+
+    def test_fact_signed_by_pinned_trusted_key_verifies(self):
+        signer, verifier = self.make_pinned_pair()
+
+        fact = signer.create_issuer_signed_fact(
+            claim="Pinned-key fact",
+            source_url="https://nature.com/articles/example",
+            source_content="source content",
+            issuer="nature.com",
+        )
+
+        result = verifier.verify_fact(fact)
+
+        self.assertTrue(result.verified)
+        self.assertEqual(result.trust_class, ev.TRUST_CLASS_ISSUER_SIGNED)
+        self.assertEqual(result.confidence, 0.95)
+
+    def test_relabelled_or_moved_fact_fails(self):
+        signer, verifier = self.make_pinned_pair()
+        fact = signer.create_issuer_signed_fact(
+            claim="Pinned-key fact",
+            source_url="https://nature.com/articles/example",
+            source_content="source content",
+            issuer="nature.com",
+        )
+
+        relabelled = copy.deepcopy(fact)
+        relabelled.issuer = "science.org"
+        relabelled_result = verifier.verify_fact(relabelled)
+
+        moved = copy.deepcopy(fact)
+        moved.source_url = "https://nature.com/articles/other"
+        moved_result = verifier.verify_fact(moved)
+
+        self.assertFalse(relabelled_result.verified)
+        self.assertEqual(relabelled_result.confidence, 0.0)
+        self.assertFalse(moved_result.verified)
+        self.assertEqual(moved_result.confidence, 0.0)
+
+    def test_reordered_citation_chain_fails(self):
+        signer, verifier = self.make_pinned_pair()
+        chain = ev.CitationChain(chain_id="test-chain")
+
+        for index in range(3):
+            chain.add_fact(
+                signer.create_issuer_signed_fact(
+                    claim=f"Claim {index}",
+                    source_url=f"https://nature.com/articles/{index}",
+                    source_content=f"source content {index}",
+                    issuer="nature.com",
+                )
+            )
+
+        signer.sign_chain(chain)
+        ok, _, error = verifier.verify_citation_chain(chain, signer.get_public_key_b64())
+        self.assertTrue(ok, error)
+
+        reordered = ev.CitationChain(
+            chain_id=chain.chain_id,
+            facts=[chain.facts[1], chain.facts[0], chain.facts[2]],
+            chain_signature=chain.chain_signature,
+        )
+        reordered_ok, _, reordered_error = verifier.verify_citation_chain(
+            reordered,
+            signer.get_public_key_b64(),
+        )
+
+        self.assertFalse(reordered_ok)
+        self.assertIn("Invalid", reordered_error)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/templates/.claude/skills/knowledge-extractor/SKILL.md

@@ -4,7 +4,7 @@ description: >
   Systematic knowledge extraction from completed projects into reusable toolkit artifacts.
   Converts project-specific code, patterns, and lessons into decontextualized, versioned,
   composable artifacts (skills, commands, hooks, rules, templates, patterns, snippets).
-  Supports two extraction modes: continuous markers during work and dedicated harvest sessions.
+  Supports continuous-marker capture during work plus dedicated harvest sessions — 4 operating modes (MARKER / QUICK / FULL / AUDIT).
   Uses swarm agents for parallel extraction across artifact categories. Domain-agnostic —
   works with any tech stack, language, or project type.
   Triggers: "harvest", "extract knowledge", "toolkit harvest", "извлечь знания",

package/templates/.claude/skills/pipeline-forge/SKILL.md

@@ -424,7 +424,11 @@ When building pipelines as distributable plugins:
 **Install Pattern:**
 ```bash
 # Remote install via curl
-curl -sL https://raw.githubusercontent.com/[org]/[repo]/main/install.sh | bash
+# Do NOT pipe a remote script straight into a shell (curl | bash) — you run unreviewed code.
+# Download, INSPECT, then execute:
+curl -fsSL https://raw.githubusercontent.com/[org]/[repo]/main/install.sh -o install.sh
+less install.sh   # review it
+bash install.sh
 
 # What install.sh does:
 # 1. Clone repo to temp directory

package/templates/.claude/skills/requirements-validator/SKILL.md

@@ -103,7 +103,7 @@ Always flag these terms and suggest specific replacements:
 - Add AC: "Given X, when Y, then Z within 200ms"
 ```
 
-### Security Acceptance Criteria (10% bonus weight)
+### Security Acceptance Criteria (scoring: +5 present / -10 missing, see Scoring Bonus below)
 
 When requirements involve authentication, data storage, external APIs, or multi-tenancy,
 apply additional security validation:
@@ -133,7 +133,7 @@ For each requirement, generate scenarios covering:
 1. **Happy path** (1-2 scenarios) — Primary success flow
 2. **Error handling** (2-3 scenarios) — Validation, network, server errors
 3. **Edge cases** (1-2 scenarios) — Boundaries, concurrent access
-4. **Security** (1-3 scenarios) — Auth bypass, injection, cross-tenant, rate limiting
+4. **Security** (generate ALL applicable from the mandatory Security BDD list above) — Auth bypass, injection, cross-tenant, rate limiting
 
 See `references/bdd-patterns.md` for Gherkin templates and examples.
 

package/templates/.claude/skills/reverse-engineering-unicorn/SKILL.md

@@ -61,7 +61,7 @@ SKILL.md (this file — orchestrator)
 |------|----------|----------|------------|------|
 | 🟢 QUICK | Static queries | Templates only | Manual X/5 | ~70 min |
 | 🔵 DEEP | GOAP A*+OODA | +GT, TRIZ, 2nd-Order, CJM proto, BS-check | Formula | ~140 min |
-| 🟣 VERIFIED | GOAP+Ed25519 | +Crypto signatures, audit trail | +Trusted issuers | ~170 min |
+| 🟣 VERIFIED | GOAP+Ed25519 | +Provenance signatures, audit trail | Pinned issuer keys where available | ~170 min |
 
 ## Pipeline
 
@@ -174,7 +174,7 @@ After CHECKPOINT 6:
 | `перерисуй [screen]` | Change one screen |
 | `без overlay` | Clean prototype for showing clients |
 
-## Anti-Hallucination Rules (ALL modes)
+## Evidence Rules (ALL modes)
 
 1. **Search First** — never answer from memory for facts
 2. **Source Attribution** — every fact → URL
@@ -182,6 +182,8 @@ After CHECKPOINT 6:
 4. **Hypotheses marked** — `[H]` tag on unverified claims
 5. **Confidence Score** — end of every module
 
+In VERIFIED mode, Ed25519 proves cryptographic provenance and tamper-evidence only when a signature verifies against an active pinned issuer key. It does not prove business facts, market sizes, reviews, or financial numbers are true.
+
 ## Module → Skill Mapping
 
 ```

package/templates/.claude/skills/reverse-engineering-unicorn/modules/01-intelligence.md

@@ -113,8 +113,10 @@ confidence = base_reliability × recency_factor
 > 1. `view(/mnt/skills/user/goap-research-ed25519/SKILL.md)`
 > 2. Установи зависимости:
 > ```bash
-> pip install cryptography --break-system-packages
+> python3 -m venv .venv
+> .venv/bin/pip install cryptography
 > ```
+> `--break-system-packages` допустим только как last-resort локальный workaround, если понятен риск изменения system Python.
 > 3. Запусти инициализацию:
 > ```python
 > # Скопируй и запусти скрипт из:
@@ -124,47 +126,31 @@ confidence = base_reliability × recency_factor
 
 **Всё из режима DEEP, плюс:**
 
-**Trusted Issuers Whitelist (для бизнес-анализа):**
+**Pinned Issuers (для бизнес-анализа):**
 ```yaml
 trusted_issuers:
   financial_data:
-    - crunchbase.com          # Level 5
-    - pitchbook.com           # Level 5
-    - sec.gov                 # Level 5
-    - bloomberg.com           # Level 4
-  tech_data:
-    - github.com              # Level 4
-    - stackshare.io           # Level 3
-  market_data:
-    - statista.com            # Level 4
-    - similarweb.com          # Level 3
-    - sensortower.com         # Level 3
-  media:
-    - techcrunch.com          # Level 4
-    - reuters.com             # Level 5
-    - forbes.com              # Level 3
-  company_official:
-    - {URL}                   # Level 4 (official but biased)
+    sec.gov:
+      pubkey_b64: "<pinned-ed25519-public-key>"
+      status: active
 ```
+Домены без pinned public key не дают issuer-grade crypto trust. Их можно использовать только через обычную source evaluation.
 
 **Для каждого найденного факта:**
 1. Извлеки claim + source_url
 2. Рассчитай `source_hash = sha256(content)`
-3. Проверь `issuer ∈ trusted_whitelist`
-4. Подпиши: `signature = Ed25519.sign(claim + source_hash + timestamp)`
+3. Если доступна подпись issuer, проверь её против pinned active key
+4. Подписываемое сообщение: canonical JSON с `issuer`, `source_url`, `claim`, `source_hash`, `timestamp`, optional `research_context`
 5. Запиши в verification ledger
 
 **Confidence Score (расширенная формула):**
 ```
-confidence = base_reliability × verification_multiplier × recency_factor
-
-verification_multiplier:
-  1.0 — unsigned (не в whitelist)
-  1.2 — issuer в trusted whitelist  
-  1.5 — подтверждено ≥2 независимыми trusted sources (chain verified)
+UNVERIFIED: 0.0 для crypto provenance
+SELF_ATTESTED: <=0.60
+ISSUER_SIGNED: min(0.95, base_reliability × recency_factor)
 ```
 
-**Verification threshold:** 0.85 (moderate) — факт считается verified если confidence ≥ 0.85
+**Verification threshold:** 0.85 (moderate). VERIFIED означает provenance/tamper-evidence под pinned key, не истинность бизнес-факта.
 
 ---
 
@@ -324,5 +310,5 @@ Chain integrity: ✅ All N facts signed, 0 breaks
 | Output columns | 3 (Параметр, Значение, Источник) | 4 (+Confidence) | Прозрачность доверия к данным |
 | Verification | "НЕ НАЙДЕНО" | + Verification Ledger, audit trail, chain integrity | Auditability |
 | Checkpoint actions | 4 варианта | 6 вариантов (+переключение режима) | Гибкость mid-flight |
-| Trusted issuers | Нет | Whitelist по категориям | Anti-hallucination |
+| Trusted issuers | Нет | Pinned-key whitelist | Provenance under pinned keys |
 | GOAP planning | Нет | A* pathfinding + OODA loop | Адаптивный research |

package/templates/.claude/skills/reverse-engineering-unicorn/modules/02-product-customers.md

@@ -76,11 +76,11 @@ sample_size_factor: 1.0 (≥20 reviews), 0.8 (10-19), 0.5 (<10)
 > ⚙️ **Дополнительно:** `view(/mnt/skills/user/goap-research-ed25519/SKILL.md)`
 
 Всё из DEEP, плюс:
-- Каждая цитата клиента подписывается с `source_url_hash`
-- Demographic claims верифицируются через trusted issuers
+- Каждая цитата клиента получает `source_hash` и, где доступно, provenance signature
+- Demographic claims проверяются через обычную source evaluation; issuer-grade crypto требует pinned issuer key
 - Verification threshold: 0.85
 
-**Note:** Отзывы клиентов по природе субъективны — Ed25519 верифицирует **что цитата реально существует по указанному URL**, а не что мнение клиента "правильное".
+**Note:** Отзывы клиентов по природе субъективны. Ed25519 доказывает только provenance/tamper-evidence под pinned key или self-attested audit trail; он не доказывает, что мнение клиента "правильное" или репрезентативное.
 
 ---
 
@@ -195,7 +195,7 @@ sample_size_factor: 1.0 (≥20 reviews), 0.8 (10-19), 0.5 (<10)
 | Скилл | Режим | Как используется |
 |-------|-------|-----------------|
 | `goap-research-ed25519` | DEEP | Адаптивный поиск отзывов: A* по платформам + OODA при пустых results |
-| `goap-research-ed25519` | VERIFIED | + верификация существования цитат по URL |
+| `goap-research-ed25519` | VERIFIED | + provenance/tamper-evidence для цитат, где есть pinned issuer signatures |
 | `references/jtbd-canvas.md` | ALL | Шаблон JTBD с примерами (Noom) |
 
 ## Checkpoint 2

package/templates/.claude/skills/reverse-engineering-unicorn/modules/03-market-competition.md

@@ -163,28 +163,21 @@ Incumbent  │  (-2, +1)    |  (0, +2)       │  Ценовая война
 
 Всё из режима DEEP, плюс:
 
-**Trusted Issuers для Market Research:**
+**Pinned Issuers для Market Research:**
 ```yaml
 trusted_issuers:
   market_reports:
-    - statista.com            # Level 4
-    - grandviewresearch.com   # Level 4
-    - mordorintelligence.com  # Level 3
+    sec.gov:
+      pubkey_b64: "<pinned-ed25519-public-key>"
+      status: active
   financial:
-    - crunchbase.com          # Level 5
-    - pitchbook.com           # Level 5
-    - sec.gov                 # Level 5
-  industry:
-    - gartner.com             # Level 5
-    - mckinsey.com            # Level 4
-    - bcg.com                 # Level 4
-  regulatory:
-    - .gov domains            # Level 5
-    - europa.eu               # Level 5
+    example-provider.com:
+      pubkey_b64: "<pinned-ed25519-public-key>"
+      status: active
 ```
 
-- Все TAM/SAM/SOM числа подписываются с source_hash
-- Competitive Matrix: каждая ячейка → verified с Confidence
+- Все TAM/SAM/SOM числа получают source_hash; issuer-grade crypto используется только при valid signature under pinned active key
+- Competitive Matrix: каждая ячейка → source URL + confidence; VERIFIED означает provenance/tamper-evidence, не истинность оценки
 - Verification threshold: **0.85** (moderate), повысить до **0.95** (strict) для инвестиционного due diligence
 
 ---

package/templates/.claude/skills/reverse-engineering-unicorn/modules/04-business-finance.md

@@ -114,9 +114,10 @@ Physical: "Команда должна быть БОЛЬШОЙ (для скор
 > ⚙️ **Дополнительно:** `view(/mnt/skills/user/goap-research-ed25519/SKILL.md)`
 
 Всё из DEEP, плюс:
-- Все benchmark числа подписываются с source_hash + issuer verification
-- Verification threshold: **0.95** (strict) — финансовые данные требуют высокой точности
-- Trusted issuers: SEC, Crunchbase, PitchBook, OpenView Partners, KeyBanc, Recurly
+- Все benchmark числа получают source_hash; issuer-grade crypto используется только при valid signature under pinned active key
+- Verification threshold: **0.95** (strict) — финансовые данные требуют высокой точности и ordinary source evaluation
+- Pinned issuers: SEC or data providers only when an Ed25519 public key is explicitly pinned. Domain names alone do not create crypto trust.
+- Ed25519 не доказывает правильность benchmark числа; он доказывает только provenance/tamper-evidence подписанного сообщения.
 
 ---
 

package/templates/.claude/skills/reverse-engineering-unicorn/modules/05-growth-engine.md

@@ -119,9 +119,10 @@ Physical: "Продукт должен быть ПРОСТЫМ (для onboardin
 > ⚙️ **Дополнительно:** `view(/mnt/skills/user/goap-research-ed25519/SKILL.md)`
 
 Всё из DEEP, плюс:
-- Traffic estimates, follower counts подписываются
-- Channel benchmarks верифицируются через trusted issuers
+- Traffic estimates и follower counts получают source_hash; issuer-grade crypto используется только при valid signature under pinned active key
+- Channel benchmarks проверяются через source evaluation, а не через domain-name trust
 - Verification threshold: 0.85
+- Ed25519 доказывает provenance/tamper-evidence подписанного сообщения; он не доказывает истинность traffic estimates или follower counts.
 
 ---