@heretek-ai/epistemic-swarm 0.2.0 → 0.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude-plugin/marketplace.json +36 -9
- package/.claude-plugin/plugin.json +47 -41
- package/MARKETPLACE.md +93 -0
- package/README.md +39 -2
- package/bin/cli.js +58 -0
- package/config/mcp_launcher.py +215 -0
- package/hooks/hooks.json +24 -0
- package/package.json +26 -3
- package/plugins/research-cache/.claude-plugin/plugin.json +15 -0
- package/plugins/socratic-grilling/.claude-plugin/plugin.json +15 -0
- package/plugins/socratic-grilling/skills/grilling/SKILL.md +48 -0
- package/plugins/socratic-grilling/skills/grilling/__init__.py +0 -0
- package/plugins/socratic-grilling/skills/grilling/socratic_tree.py +148 -0
- package/prompts/agent_code_auditor.md +88 -0
- package/prompts/agent_oss_scout.md +78 -0
- package/runner/__pycache__/__init__.cpython-311.pyc +0 -0
- package/runner/__pycache__/auditor_engine.cpython-311.pyc +0 -0
- package/runner/__pycache__/research_swarm.cpython-311.pyc +0 -0
- package/runner/__pycache__/state_machine.cpython-311.pyc +0 -0
- package/runner/research_swarm.py +230 -81
- package/runner/tests/__pycache__/test_swarm.cpython-311.pyc +0 -0
- package/runner/tests/test_swarm.py +37 -0
- package/skills/code_audit/SKILL.md +45 -0
- package/skills/epistemic_search/SKILL.md +35 -0
- package/skills/epistemic_search/__init__.py +1 -0
- package/skills/epistemic_search/scripts/fetch.py +157 -0
- package/skills/epistemic_search/scripts/search.py +162 -0
- package/skills/oss_scout/SKILL.md +49 -0
- package/skills/research_cache/SKILL.md +36 -0
- package/skills/research_cache/__init__.py +0 -0
- package/skills/research_cache/__pycache__/__init__.cpython-311.pyc +0 -0
- package/skills/{research-cache → research_cache}/__pycache__/hasher.cpython-311.pyc +0 -0
- package/skills/research_cache/hasher.py +195 -0
- package/skills/swarm_config/SKILL.md +72 -0
- package/skills/swarm_config/__init__.py +4 -0
- package/skills/swarm_config/__pycache__/__init__.cpython-311.pyc +0 -0
- package/skills/swarm_config/__pycache__/configure.cpython-311.pyc +0 -0
- package/skills/swarm_config/configure.py +167 -0
- package/skills/research-cache/__pycache__/__init__.cpython-311.pyc +0 -0
- /package/{skills/research-cache → plugins/research-cache/skills/research_cache}/SKILL.md +0 -0
- /package/{skills/research-cache → plugins/research-cache/skills/research_cache}/__init__.py +0 -0
- /package/{skills/research-cache → plugins/research-cache/skills/research_cache}/hasher.py +0 -0
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@heretek-ai/epistemic-swarm",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.2",
|
|
4
4
|
"description": "IUMBTEMS: I Use My Brain To Express My Self — High-Integrity Dialectic Research Agent Harness for Claude Code, Pi (pi.dev), and OpenCode V2",
|
|
5
5
|
"main": "bin/cli.js",
|
|
6
6
|
"bin": {
|
|
@@ -26,17 +26,33 @@
|
|
|
26
26
|
"homepage": "https://github.com/Heretek-AI/IUMBTEMS#readme",
|
|
27
27
|
"keywords": [
|
|
28
28
|
"iumbtems",
|
|
29
|
+
"i-use-my-brain-to-express-my-self",
|
|
29
30
|
"pi-package",
|
|
30
31
|
"opencode",
|
|
31
32
|
"opencode-plugin",
|
|
32
33
|
"claude-code",
|
|
33
34
|
"ai-agents",
|
|
35
|
+
"autonomous-agents",
|
|
36
|
+
"multi-agent-systems",
|
|
34
37
|
"dialectic-swarm",
|
|
38
|
+
"dialectic",
|
|
35
39
|
"epistemic-integrity",
|
|
36
40
|
"research-harness",
|
|
41
|
+
"research-agent",
|
|
37
42
|
"mcp",
|
|
43
|
+
"model-context-protocol",
|
|
44
|
+
"mcp-servers",
|
|
38
45
|
"deep-research",
|
|
39
|
-
"socratic-grilling"
|
|
46
|
+
"socratic-grilling",
|
|
47
|
+
"socratic-questioning",
|
|
48
|
+
"fact-checking",
|
|
49
|
+
"red-teaming",
|
|
50
|
+
"citation-validation",
|
|
51
|
+
"hallucination-prevention",
|
|
52
|
+
"swarm-intelligence",
|
|
53
|
+
"code-audit",
|
|
54
|
+
"oss-scout",
|
|
55
|
+
"clean-room-engineering"
|
|
40
56
|
],
|
|
41
57
|
"pi": {
|
|
42
58
|
"extensions": [
|
|
@@ -44,7 +60,11 @@
|
|
|
44
60
|
],
|
|
45
61
|
"skills": [
|
|
46
62
|
"./skills/grilling",
|
|
47
|
-
"./skills/
|
|
63
|
+
"./skills/research_cache",
|
|
64
|
+
"./skills/epistemic_search",
|
|
65
|
+
"./skills/swarm_config",
|
|
66
|
+
"./skills/code_audit",
|
|
67
|
+
"./skills/oss_scout"
|
|
48
68
|
],
|
|
49
69
|
"prompts": [
|
|
50
70
|
"./prompts/*.md"
|
|
@@ -56,6 +76,7 @@
|
|
|
56
76
|
"bin",
|
|
57
77
|
"prompts",
|
|
58
78
|
"skills",
|
|
79
|
+
"hooks",
|
|
59
80
|
"config",
|
|
60
81
|
"runner",
|
|
61
82
|
"extensions",
|
|
@@ -63,6 +84,7 @@
|
|
|
63
84
|
".claude-plugin",
|
|
64
85
|
"install.sh",
|
|
65
86
|
"README.md",
|
|
87
|
+
"MARKETPLACE.md",
|
|
66
88
|
"LICENSE"
|
|
67
89
|
],
|
|
68
90
|
"engines": {
|
|
@@ -70,6 +92,7 @@
|
|
|
70
92
|
},
|
|
71
93
|
"scripts": {
|
|
72
94
|
"test": "python3 -m unittest discover -s runner/tests",
|
|
95
|
+
"validate:claude": "claude plugin validate --strict .claude-plugin/marketplace.json && claude plugin validate --strict .",
|
|
73
96
|
"prepack": "python3 -m unittest discover -s runner/tests",
|
|
74
97
|
"install-local": "bash install.sh"
|
|
75
98
|
}
|
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "research-cache",
|
|
3
|
+
"version": "0.2.0",
|
|
4
|
+
"description": "Content-addressed SHA256 Markdown source hashing and verbatim quote verification engine.",
|
|
5
|
+
"author": {
|
|
6
|
+
"name": "Heretek AI",
|
|
7
|
+
"email": "dev@heretek.ai"
|
|
8
|
+
},
|
|
9
|
+
"license": "Apache-2.0",
|
|
10
|
+
"repository": "https://github.com/Heretek-AI/IUMBTEMS",
|
|
11
|
+
"homepage": "https://github.com/Heretek-AI/IUMBTEMS#readme",
|
|
12
|
+
"skills": [
|
|
13
|
+
"./skills/research_cache"
|
|
14
|
+
]
|
|
15
|
+
}
|
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "socratic-grilling",
|
|
3
|
+
"version": "0.2.0",
|
|
4
|
+
"description": "Matt Pocock-style Socratic interrogation, premise inversion, and lateral exploration skill for Claude Code.",
|
|
5
|
+
"author": {
|
|
6
|
+
"name": "Heretek AI",
|
|
7
|
+
"email": "dev@heretek.ai"
|
|
8
|
+
},
|
|
9
|
+
"license": "Apache-2.0",
|
|
10
|
+
"repository": "https://github.com/Heretek-AI/IUMBTEMS",
|
|
11
|
+
"homepage": "https://github.com/Heretek-AI/IUMBTEMS#readme",
|
|
12
|
+
"skills": [
|
|
13
|
+
"./skills/grilling"
|
|
14
|
+
]
|
|
15
|
+
}
|
|
@@ -0,0 +1,48 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: grilling
|
|
3
|
+
description: Socratic grilling and assumption-inversion skill for deep research. Uses Matt Pocock-style design trees to explore the problem frontier divergently before committing to search queries.
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# Socratic Grilling & Divergent Research Framing
|
|
7
|
+
|
|
8
|
+
Interview the user relentlessly until you reach an airtight, shared understanding of the research scope. Map the problem as a **design tree**: every foundational assumption branches into the technical decisions and empirical hypotheses that hang off it.
|
|
9
|
+
|
|
10
|
+
## 1. THE FRONTIER METHODOLOGY
|
|
11
|
+
|
|
12
|
+
1. Work the tree in **rounds**.
|
|
13
|
+
2. The **frontier** is every decision whose prerequisites are already settled: the questions you can ask *now* without guessing at answers you haven't heard yet.
|
|
14
|
+
3. Ask the whole frontier in one round: number each question and provide your recommended answer.
|
|
15
|
+
4. Then wait for the user's answers before moving to the next round.
|
|
16
|
+
|
|
17
|
+
## 2. FORMATTING A ROUND
|
|
18
|
+
|
|
19
|
+
```
|
|
20
|
+
❓ **Q1 - <Question Title>**: <Question context, premise inversion, trade-offs, multiple options>
|
|
21
|
+
|
|
22
|
+
➡️ **Recommended**: <Your recommended answer with rationale>
|
|
23
|
+
|
|
24
|
+
---
|
|
25
|
+
|
|
26
|
+
❓ **Q2 - <Question Title>**: <Question context, trade-offs>
|
|
27
|
+
|
|
28
|
+
➡️ **Recommended**: <Your recommended answer with rationale>
|
|
29
|
+
```
|
|
30
|
+
|
|
31
|
+
## 3. FACTUAL VS. DECISIONAL SEPARATION
|
|
32
|
+
|
|
33
|
+
- **Facts are the agent's job**: When a frontier question hinges on an empirical fact (e.g. library benchmarks, API specs, hardware limits), **DO NOT ASK THE USER**. Dispatch a tool call or subagent to look it up in the codebase or online.
|
|
34
|
+
- **Decisions are the user's**: High-level trade-offs, architectural philosophy, threat models, and priority ranking belong to the user. Put each decision to them clearly.
|
|
35
|
+
|
|
36
|
+
## 4. ASSUMPTION INVERSION TACTICS
|
|
37
|
+
|
|
38
|
+
Always challenge default premises in Round 1:
|
|
39
|
+
- *Inversion*: What if the primary objective is rendered obsolete by a radical alternative?
|
|
40
|
+
- *Scale Extremes*: What breaks at 100x scale? What breaks at 0 resources?
|
|
41
|
+
- *Adversarial Posture*: How would an intelligent adversary exploit or falsify this design?
|
|
42
|
+
|
|
43
|
+
## 5. FRONTIER RESOLUTION & FREEZING
|
|
44
|
+
|
|
45
|
+
When every branch of the design tree has been visited and the frontier is empty:
|
|
46
|
+
1. Summarize the settled constraints.
|
|
47
|
+
2. Save the settled state to `.research/frontier.json` using `python3 skills/grilling/socratic_tree.py --export`.
|
|
48
|
+
3. Hand off the settled frontier to the **Swarm Orchestrator** to begin empirical dialectic execution.
|
|
File without changes
|
|
@@ -0,0 +1,148 @@
|
|
|
1
|
+
#!/usr/bin/env python3
|
|
2
|
+
"""
|
|
3
|
+
Socratic Tree & Decision Frontier Engine for Epistemic Swarm.
|
|
4
|
+
Implements Matt Pocock-style design tree traversal to isolate the active decision frontier.
|
|
5
|
+
"""
|
|
6
|
+
|
|
7
|
+
import sys
|
|
8
|
+
import json
|
|
9
|
+
import argparse
|
|
10
|
+
from pathlib import Path
|
|
11
|
+
from typing import Dict, List, Optional, Any
|
|
12
|
+
|
|
13
|
+
class DecisionNode:
|
|
14
|
+
def __init__(self, node_id: str, title: str, question: str,
|
|
15
|
+
recommended: str, options: Optional[List[str]] = None,
|
|
16
|
+
prerequisites: Optional[List[str]] = None):
|
|
17
|
+
self.node_id = node_id
|
|
18
|
+
self.title = title
|
|
19
|
+
self.question = question
|
|
20
|
+
self.recommended = recommended
|
|
21
|
+
self.options = options or []
|
|
22
|
+
self.prerequisites = prerequisites or []
|
|
23
|
+
self.settled_answer: Optional[str] = None
|
|
24
|
+
|
|
25
|
+
def is_settled(self) -> bool:
|
|
26
|
+
return self.settled_answer is not None
|
|
27
|
+
|
|
28
|
+
def to_dict(self) -> Dict[str, Any]:
|
|
29
|
+
return {
|
|
30
|
+
"node_id": self.node_id,
|
|
31
|
+
"title": self.title,
|
|
32
|
+
"question": self.question,
|
|
33
|
+
"recommended": self.recommended,
|
|
34
|
+
"options": self.options,
|
|
35
|
+
"prerequisites": self.prerequisites,
|
|
36
|
+
"settled_answer": self.settled_answer
|
|
37
|
+
}
|
|
38
|
+
|
|
39
|
+
@classmethod
|
|
40
|
+
def from_dict(cls, data: Dict[str, Any]) -> 'DecisionNode':
|
|
41
|
+
node = cls(
|
|
42
|
+
node_id=data["node_id"],
|
|
43
|
+
title=data["title"],
|
|
44
|
+
question=data["question"],
|
|
45
|
+
recommended=data["recommended"],
|
|
46
|
+
options=data.get("options", []),
|
|
47
|
+
prerequisites=data.get("prerequisites", [])
|
|
48
|
+
)
|
|
49
|
+
node.settled_answer = data.get("settled_answer")
|
|
50
|
+
return node
|
|
51
|
+
|
|
52
|
+
|
|
53
|
+
class DesignTree:
|
|
54
|
+
def __init__(self, objective: str):
|
|
55
|
+
self.objective = objective
|
|
56
|
+
self.nodes: Dict[str, DecisionNode] = {}
|
|
57
|
+
|
|
58
|
+
def add_node(self, node: DecisionNode):
|
|
59
|
+
self.nodes[node.node_id] = node
|
|
60
|
+
|
|
61
|
+
def compute_frontier(self) -> List[DecisionNode]:
|
|
62
|
+
"""
|
|
63
|
+
The frontier is all unsettled nodes whose prerequisites are ALL settled.
|
|
64
|
+
"""
|
|
65
|
+
frontier = []
|
|
66
|
+
for node in self.nodes.values():
|
|
67
|
+
if node.is_settled():
|
|
68
|
+
continue
|
|
69
|
+
prereqs_met = True
|
|
70
|
+
for prereq_id in node.prerequisites:
|
|
71
|
+
prereq_node = self.nodes.get(prereq_id)
|
|
72
|
+
if not prereq_node or not prereq_node.is_settled():
|
|
73
|
+
prereqs_met = False
|
|
74
|
+
break
|
|
75
|
+
if prereqs_met:
|
|
76
|
+
frontier.append(node)
|
|
77
|
+
return frontier
|
|
78
|
+
|
|
79
|
+
def settle_node(self, node_id: str, answer: str):
|
|
80
|
+
if node_id in self.nodes:
|
|
81
|
+
self.nodes[node_id].settled_answer = answer
|
|
82
|
+
|
|
83
|
+
def is_complete(self) -> bool:
|
|
84
|
+
return len(self.compute_frontier()) == 0 and all(n.is_settled() for n in self.nodes.values())
|
|
85
|
+
|
|
86
|
+
def export_frontier_json(self, output_path: Path):
|
|
87
|
+
output_path.parent.mkdir(parents=True, exist_ok=True)
|
|
88
|
+
data = {
|
|
89
|
+
"objective": self.objective,
|
|
90
|
+
"is_complete": self.is_complete(),
|
|
91
|
+
"nodes": {k: v.to_dict() for k, v in self.nodes.items()},
|
|
92
|
+
"settled_constraints": {
|
|
93
|
+
k: v.settled_answer for k, v in self.nodes.items() if v.is_settled()
|
|
94
|
+
}
|
|
95
|
+
}
|
|
96
|
+
with open(output_path, "w", encoding="utf-8") as f:
|
|
97
|
+
json.dump(data, f, indent=2)
|
|
98
|
+
|
|
99
|
+
@classmethod
|
|
100
|
+
def load_from_json(cls, file_path: Path) -> 'DesignTree':
|
|
101
|
+
with open(file_path, "r", encoding="utf-8") as f:
|
|
102
|
+
data = json.load(f)
|
|
103
|
+
tree = cls(objective=data["objective"])
|
|
104
|
+
for k, v in data.get("nodes", {}).items():
|
|
105
|
+
tree.add_node(DecisionNode.from_dict(v))
|
|
106
|
+
return tree
|
|
107
|
+
|
|
108
|
+
|
|
109
|
+
def main():
|
|
110
|
+
parser = argparse.ArgumentParser(description="Epistemic Swarm Socratic Decision Tree")
|
|
111
|
+
parser.add_argument("--objective", type=str, help="Research objective")
|
|
112
|
+
parser.add_argument("--file", type=str, default=".research/frontier.json", help="Path to frontier.json")
|
|
113
|
+
parser.add_argument("--show-frontier", action="store_true", help="Print the current decision frontier")
|
|
114
|
+
parser.add_argument("--settle", nargs=2, metavar=("NODE_ID", "ANSWER"), help="Settle a decision node")
|
|
115
|
+
|
|
116
|
+
args = parser.parse_args()
|
|
117
|
+
frontier_path = Path(args.file)
|
|
118
|
+
|
|
119
|
+
if frontier_path.exists():
|
|
120
|
+
tree = DesignTree.load_from_json(frontier_path)
|
|
121
|
+
else:
|
|
122
|
+
objective = args.objective or "Epistemic Swarm Research Objective"
|
|
123
|
+
tree = DesignTree(objective=objective)
|
|
124
|
+
|
|
125
|
+
if args.settle:
|
|
126
|
+
node_id, answer = args.settle
|
|
127
|
+
tree.settle_node(node_id, answer)
|
|
128
|
+
tree.export_frontier_json(frontier_path)
|
|
129
|
+
print(f"Settled {node_id} -> {answer}")
|
|
130
|
+
|
|
131
|
+
frontier = tree.compute_frontier()
|
|
132
|
+
if args.show_frontier or not args.settle:
|
|
133
|
+
print(f"\n🎯 Objective: {tree.objective}")
|
|
134
|
+
print(f"📊 Total Nodes: {len(tree.nodes)} | Settled: {sum(1 for n in tree.nodes.values() if n.is_settled())}")
|
|
135
|
+
if not frontier:
|
|
136
|
+
if tree.nodes and tree.is_complete():
|
|
137
|
+
print("✅ Frontier is EMPTY. All prerequisite branches are fully settled!")
|
|
138
|
+
else:
|
|
139
|
+
print("ℹ️ No active frontier nodes. Define new decision nodes to begin grilling.")
|
|
140
|
+
else:
|
|
141
|
+
print(f"\n⚡ Current Active Frontier ({len(frontier)} questions ready):")
|
|
142
|
+
for idx, node in enumerate(frontier, 1):
|
|
143
|
+
print(f"\n❓ Q{idx} [{node.node_id}] - {node.title}")
|
|
144
|
+
print(f" {node.question}")
|
|
145
|
+
print(f" ➡️ Recommended: {node.recommended}")
|
|
146
|
+
|
|
147
|
+
if __name__ == "__main__":
|
|
148
|
+
main()
|
|
@@ -0,0 +1,88 @@
|
|
|
1
|
+
# AGENT CODE AUDITOR: DIALECTIC CODEBASE AUDITING SPECIFICATION
|
|
2
|
+
|
|
3
|
+
You are the **Codebase Auditor Engine** within the Epistemic Swarm harness. Your role is executing rigorous, evidentiary, dialectic audits of software repositories for architecture, security, performance, and correctness.
|
|
4
|
+
|
|
5
|
+
---
|
|
6
|
+
|
|
7
|
+
## 1. POSTURE & OBJECTIVE
|
|
8
|
+
|
|
9
|
+
- **Dialectic Structure**:
|
|
10
|
+
- **Alpha (Structural Architect)**: Identifies system topology, design invariants, data flow pipelines, state transitions, and intended security boundaries.
|
|
11
|
+
- **Beta (Adversarial Red-Teamer)**: Probes for vulnerability exploits, race conditions, memory leaks, unhandled exceptions, authorization bypasses, injection vectors, and architectural anti-patterns.
|
|
12
|
+
- **Strict Evidence Mandate**:
|
|
13
|
+
- Every architectural claim or vulnerability assertion MUST cite the exact relative file path and line number range: `[PATH: <filepath>#L<start>-L<end>]`.
|
|
14
|
+
- Every finding MUST include the exact verbatim code excerpt from the repository.
|
|
15
|
+
- Unsubstantiated generalizations ("the code might have concurrency issues") are strictly prohibited.
|
|
16
|
+
|
|
17
|
+
---
|
|
18
|
+
|
|
19
|
+
## 2. AUDIT VECTORS
|
|
20
|
+
|
|
21
|
+
1. **Security & Vulnerabilities (CWE/OWASP)**:
|
|
22
|
+
- Command injection, SQL injection, path traversal, deserialization flaws.
|
|
23
|
+
- Broken authentication, authorization bypass, privilege escalation.
|
|
24
|
+
- Cryptographic misuse, weak RNG, hardcoded secrets.
|
|
25
|
+
2. **Concurrency & Thread Safety**:
|
|
26
|
+
- Data races, deadlock conditions, uncoordinated shared state mutations, async cancellation leaks.
|
|
27
|
+
3. **Resource Lifecycle & Memory Safety**:
|
|
28
|
+
- Unclosed file descriptors, socket leaks, unbounded queue memory growth, unbounded caching.
|
|
29
|
+
4. **Architectural Cohesion & Invariants**:
|
|
30
|
+
- Violations of layer separation, cyclic dependencies, God classes, hidden side effects.
|
|
31
|
+
5. **Error & Failure Boundary Handling**:
|
|
32
|
+
- Swallowed exceptions, partial state commits during failures, missing retry backoffs.
|
|
33
|
+
|
|
34
|
+
---
|
|
35
|
+
|
|
36
|
+
## 3. OUTPUT SPECIFICATIONS
|
|
37
|
+
|
|
38
|
+
Findings are stored in `.research/scratchpads/{scope_id}/`:
|
|
39
|
+
|
|
40
|
+
### 1. `code_audit_dossier.json`
|
|
41
|
+
```json
|
|
42
|
+
{
|
|
43
|
+
"mode": "code_audit",
|
|
44
|
+
"scope_id": "<scope_id>",
|
|
45
|
+
"target_directory": "<path>",
|
|
46
|
+
"timestamp": "<ISO-8601>",
|
|
47
|
+
"architectural_invariants": [
|
|
48
|
+
{
|
|
49
|
+
"invariant_id": "INV-01",
|
|
50
|
+
"statement": "<Description of structural guarantee or design contract>",
|
|
51
|
+
"file_path": "runner/research_swarm.py",
|
|
52
|
+
"line_range": "27-35",
|
|
53
|
+
"code_snippet": "<Verbatim excerpt>",
|
|
54
|
+
"status": "VERIFIED_SOUND | COMPROMISED"
|
|
55
|
+
}
|
|
56
|
+
],
|
|
57
|
+
"vulnerability_findings": [
|
|
58
|
+
{
|
|
59
|
+
"finding_id": "VULN-01",
|
|
60
|
+
"severity": "CRITICAL | HIGH | MEDIUM | LOW | TECH_DEBT",
|
|
61
|
+
"cwe_id": "CWE-362 | CWE-78 | etc",
|
|
62
|
+
"title": "<Concise vulnerability title>",
|
|
63
|
+
"description": "<Detailed explanation of vulnerability mechanics>",
|
|
64
|
+
"file_path": "skills/epistemic_search/scripts/search.py",
|
|
65
|
+
"line_range": "42-55",
|
|
66
|
+
"code_snippet": "<Verbatim excerpt>",
|
|
67
|
+
"exploit_scenario": "<Concrete sequence triggering failure>",
|
|
68
|
+
"remediation": "<Specific code fix recommendation>"
|
|
69
|
+
}
|
|
70
|
+
],
|
|
71
|
+
"tech_debt_and_refactoring": [
|
|
72
|
+
{
|
|
73
|
+
"issue_id": "DEBT-01",
|
|
74
|
+
"file_path": "bin/cli.js",
|
|
75
|
+
"line_range": "53-67",
|
|
76
|
+
"pattern": "Subprocess execution without timeout",
|
|
77
|
+
"recommendation": "Add explicit execution timeout bounds"
|
|
78
|
+
}
|
|
79
|
+
]
|
|
80
|
+
}
|
|
81
|
+
```
|
|
82
|
+
|
|
83
|
+
### 2. `code_audit_report.md`
|
|
84
|
+
A structured, actionable security & architectural audit brief containing:
|
|
85
|
+
- Executive Summary & Overall Code Health Score (0-100)
|
|
86
|
+
- Critical & High Severity Vulnerability Breakdown with Code Pointers
|
|
87
|
+
- Concurrency & Resource Safety Analysis
|
|
88
|
+
- Step-by-Step Remediation Action Plan with Diff Blueprints
|
|
@@ -0,0 +1,78 @@
|
|
|
1
|
+
# AGENT OSS SCOUT: OPEN SOURCE EXPLORATION & VETTING SPECIFICATION
|
|
2
|
+
|
|
3
|
+
You are the **Open Source Scout Engine** within the Epistemic Swarm harness. Your role is finding, vetting, and distilling open-source software libraries, algorithms, and reference implementations to accelerate research-based development.
|
|
4
|
+
|
|
5
|
+
---
|
|
6
|
+
|
|
7
|
+
## 1. POSTURE & OBJECTIVE
|
|
8
|
+
|
|
9
|
+
- **Dialectic Structure**:
|
|
10
|
+
- **Alpha (Discovery Scout)**: Finds leading open-source repositories, libraries, and reference implementations across GitHub, GitLab, and package ecosystems (npm, PyPI, Crates.io, Go Modules). Gathers performance benchmarks and API elegance proofs.
|
|
11
|
+
- **Beta (Adversarial Vetting / License Red-Team)**: Scrutinizes candidate projects for license contamination (GPL/AGPL vs. MIT/Apache), maintenance stagnation (abandonware), security CVEs, transitive dependency explosions, and architectural bloat.
|
|
12
|
+
- **Strict Evidence Mandate**:
|
|
13
|
+
- Every evaluated repository MUST be cached with its content hash: `[VERIFIED: <source_hash>]`.
|
|
14
|
+
- Stated benchmark numbers or API signatures MUST be exact quotes from cached documentation.
|
|
15
|
+
- License claims MUST be corroborated by the repository's `LICENSE` file content.
|
|
16
|
+
|
|
17
|
+
---
|
|
18
|
+
|
|
19
|
+
## 2. VETTING CRITERIA
|
|
20
|
+
|
|
21
|
+
1. **License & Contamination Risk**:
|
|
22
|
+
- Classify licenses: Permissive (MIT, Apache-2.0, BSD-3-Clause, ISC) vs. Weak Copyleft (LGPL, MPL) vs. Strong Copyleft (GPL, AGPL).
|
|
23
|
+
- If user project has a commercial or permissive license, red-team any viral copyleft risks.
|
|
24
|
+
2. **Maintenance Health & Sustainability**:
|
|
25
|
+
- Commit frequency, release cadence, last commit date.
|
|
26
|
+
- Ratio of open-to-closed issues, responsive maintainer activity.
|
|
27
|
+
- Bus factor (single-maintainer vulnerability vs active foundation/consortium).
|
|
28
|
+
3. **Dependency Weight & Attack Surface**:
|
|
29
|
+
- Transitive dependency tree depth and bundle weight.
|
|
30
|
+
- Known vulnerabilities (CVEs, npm audit warnings, Dependabot advisories).
|
|
31
|
+
4. **Clean-Room Implementation Feasibility**:
|
|
32
|
+
- Can the core algorithm or pattern be cleanly re-implemented in-tree without importing the entire dependency?
|
|
33
|
+
|
|
34
|
+
---
|
|
35
|
+
|
|
36
|
+
## 3. OUTPUT SPECIFICATIONS
|
|
37
|
+
|
|
38
|
+
Findings are stored in `.research/scratchpads/{scope_id}/`:
|
|
39
|
+
|
|
40
|
+
### 1. `oss_scout_dossier.json`
|
|
41
|
+
```json
|
|
42
|
+
{
|
|
43
|
+
"mode": "oss_scout",
|
|
44
|
+
"scope_id": "<scope_id>",
|
|
45
|
+
"target_feature": "<feature_description>",
|
|
46
|
+
"timestamp": "<ISO-8601>",
|
|
47
|
+
"candidate_repositories": [
|
|
48
|
+
{
|
|
49
|
+
"repo_id": "OSS-01",
|
|
50
|
+
"name": "owner/repo",
|
|
51
|
+
"url": "https://github.com/owner/repo",
|
|
52
|
+
"source_hash": "<sha256>",
|
|
53
|
+
"license": "Apache-2.0",
|
|
54
|
+
"license_risk": "SAFE | COPYLEFT_WARNING | PROHIBITIVE",
|
|
55
|
+
"stars": 4500,
|
|
56
|
+
"last_release": "2026-03-12",
|
|
57
|
+
"maintenance_status": "VIBRANT | STABLE | SLOW | ABANDONED",
|
|
58
|
+
"pros": ["Zero transitive dependencies", "Written in Rust with Python FFI bindings"],
|
|
59
|
+
"cons": ["Lacks comprehensive async support"],
|
|
60
|
+
"transitive_dependency_count": 0,
|
|
61
|
+
"benchmark_quote": "<Exact quote from README/docs>",
|
|
62
|
+
"clean_room_blueprint_available": true
|
|
63
|
+
}
|
|
64
|
+
],
|
|
65
|
+
"adjudication_verdict": {
|
|
66
|
+
"recommended_approach": "ADOPT_DEPENDENCY | CLEAN_ROOM_REIMPLEMENT | REJECT",
|
|
67
|
+
"selected_target": "owner/repo",
|
|
68
|
+
"rationale": "<Evidence-backed justification>"
|
|
69
|
+
}
|
|
70
|
+
}
|
|
71
|
+
```
|
|
72
|
+
|
|
73
|
+
### 2. `oss_scout_report.md`
|
|
74
|
+
A comprehensive open-source market survey and implementation guide containing:
|
|
75
|
+
- Competitive Matrix of evaluated libraries (License, Stars, Maintenance, Bundle Size)
|
|
76
|
+
- Risk Analysis (Adversarial Red-Team vetting of CVEs, bloat, copyleft)
|
|
77
|
+
- Clean-Room Implementation Blueprint (Algorithm breakdown for in-tree borrowing without licensing risks)
|
|
78
|
+
- Direct Integration Guide (Code examples and setup steps if adopting directly)
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|