@xaccefy/pi-casefile 0.2.1 → 0.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xaccefy/pi-casefile",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Offensive security case tracker for Pi Agent — bug bounties, CTFs, security audits",
   "keywords": [
     "pi-package",

package/skills/casefile/SKILL.md

@@ -13,11 +13,23 @@ Use Casefile to maintain durable security investigation state across agent turns
 1. Check existing cases before opening a new one with CaseList or CaseSearch.
 2. Open new leads with CaseAdd as `hypothesis` or `investigating`.
 3. Promote cases with CaseUpdate only after materially new evidence, proof, impact, blockers, remediation, or status changes.
-4. Mark `confirmed` only when evidence and a PoC or repro are recorded.
+4. Mark `confirmed` only via PromoteFinding after a real PoC exit 0 (evidence, impact, severity, poc required).
 5. Use CaseLink and CaseUnlink for exploit chains. Do not edit linked case IDs directly.
-6. Use CaseReport only for confirmed or already reported cases.
+6. Use CaseReport only for confirmed or already reported cases, then CaseUpdate status=`reported`.
 7. Use `killed` for disproven, duplicate, or dead-end leads, and include evidence, blockers, next step, or assumptions explaining why.
 
+## State machine
+
+```
+hypothesis → investigating → confirmed → reported
+                 ↓               ↓
+              blocked         killed (terminal)
+```
+
+- investigating requires evidence + confidence
+- confirmed requires PromoteFinding (not CaseUpdate)
+- killed/reported are terminal (no field edits or re-links)
+
 ## Tool Map
 
 - `CaseAdd`: create a new case.

package/src/index.ts

@@ -3,7 +3,7 @@
  *
  * Tools: CaseAdd, CaseUpdate, PromoteFinding, CaseGet, CaseList, CaseSearch, CaseLink, CaseUnlink, CaseReport
  * Command: /casefile — interactive dashboard
- * Event: before_agent_start — injects case summary context into the system prompt
+ * Event: before_agent_start — injects cyber workflow (+ active case list) once per user prompt
  */
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
@@ -324,11 +324,20 @@ class CasefileDashboard {
 }
 
 // ── Context injection ─────────────────────────────────────────────────
+// Injected once per user prompt via before_agent_start (not every tool turn).
+// Skills are opt-in; this keeps bounty discipline always present even with an empty ledger.
 
 const STATIC_CYBER_WORKFLOW = `
-# Cyber Workflow
+# Cyber Workflow (Attacker-Oriented)
 
-Every finding starts HYPOTHESIS. Nothing reaches CONFIRMED without a working PoC on disk. Optimize for correctness over novelty. Prefer rejecting a real bug temporarily rather than reporting a false positive. Every confirmed finding must survive skeptical review by another experienced security researcher.
+Think like a real external attacker, not a code reviewer. Technical bugs are cheap; **reachable attacker impact** is what matters for bounty-valid findings.
+
+Every lead starts HYPOTHESIS. Nothing reaches CONFIRMED without:
+1. a working PoC on disk,
+2. a proven attacker path (who can trigger it, from where),
+3. demonstrated C/I/A impact (not theoretical).
+
+Prefer killing a cute-but-unusable bug over reporting noise. Every confirmed finding must survive skeptical review by another experienced security researcher **and** a program triage engineer.
 
 ## State Machine (CaseAdd → CaseUpdate → CaseReport)
 
@@ -343,96 +352,147 @@ HYPOTHESIS ──→ INVESTIGATING ──→ CONFIRMED ──→ REPORTED
 
 | Advance To | Required Case Fields | Must Exist on Disk |
 |-----------|---------------------|--------------------|
-| INVESTIGATING | \`evidence\` (source→sink trace), \`confidence\` | Path trace in notes |
-| **CONFIRMED** | \`evidence\`, **\`poc\`**, \`impact\`, \`severity\`, **\`impact_proof\`** | **PoC script + run.log with exit code 0, impact evidence on disk** |
-| KILLED | \`assumptions\` (why it died) | — |
+| INVESTIGATING | \`evidence\` (source→sink + **attacker reachability**), \`confidence\` | Path trace in notes |
+| **CONFIRMED** | \`evidence\`, **\`poc\`**, \`impact\` (attacker-real), \`severity\`, **\`impact_proof\`** | **PoC script + run.log exit 0 + proof of impact** |
+| KILLED | \`assumptions\` (why it died: no path / no impact / not applicable) | — |
 | REPORTED | Only after \`CaseReport(id)\` succeeds | Report file |
 
 **Rule: If a required field is empty, you cannot advance.** \`CaseUpdate({status:"confirmed", poc:""})\` is invalid. The fields are the gates.
 
 ---
 
-## 1. Evidence-First Doctrine (Highest Priority)
+## 0. Attacker Model (Read First)
+
+Before escalating any finding, answer in evidence:
+
+1. **Who is the attacker?** (unauth internet, low-priv user, tenant peer, SSRF pivot, etc.)
+2. **What can they already do without the bug?** (baseline privileges)
+3. **What extra power does the bug grant beyond that baseline?**
+4. **Is the path realistic in production?** (auth, CSRF, WAF, network, feature flags, admin-only)
+
+If you cannot name a concrete attacker who gains something they should not have → do **not** confirm. Keep as hypothesis/investigating, or kill as \`insufficient_impact\` / \`environmental_issue\`.
+
+**Non-applicable / weak-impact defaults (KILL or do not promote):**
+- Self-XSS / self-DoS only (attacker harms only their own session/account)
+- Requires admin/root/already-trusted role that already has the same power
+- Local-only, offline, or impossible deployment assumptions
+- Spec-compliant / documented intentional behavior
+- Needs physical access, victim to paste payload into their own console, or other social-engineering-only steps with no trust-boundary break
+- "Interesting" logic quirks with **no confidentiality, integrity, availability, or financial effect**
+- PoC proves a code path exists but **not** that a real victim asset is affected
+
+Technical validity ≠ bounty validity. A true bug with no attacker-usable impact is still a kill for confirmed/report.
+
+---
+
+## 1. Evidence-First Doctrine
 Evidence overrides intuition. Never present speculation as fact. Every security claim must be traceable to:
 - Observed behavior (logs, responses, error traces)
 - Reproduced behavior (exact steps, scripts)
 - Source code / protocol analysis
 - Documented platform behavior
-If evidence is insufficient: explicitly state uncertainty, propose the next experiment, and do not escalate the finding. Produce the strongest conclusion supported by available evidence; never assume success where verification is incomplete.
+If evidence is insufficient: state uncertainty, propose the next experiment, do not escalate. Never assume success where verification is incomplete.
+
+---
+
+## 2. Impact Gate (Mandatory Before CONFIRMED)
+
+Prove at least **one** real attacker-facing violation:
+
+| Category | Required proof |
+|----------|----------------|
+| **Confidentiality** | Attacker reads data they must not see (other users/tenants/secrets) |
+| **Integrity** | Attacker changes data/state they must not control |
+| **Availability** | Attacker degrades service for **others** (not only self) |
+| **Financial / authz** | Direct money, privilege, or account takeover path |
+
+Impact text must answer: *who is hurt, what is lost, how the attacker reaches it.*  
+Vague impact like "could be dangerous" or "may lead to RCE" without a path is not impact_proof.
+
+If impact is only theoretical, needs a second unproven bug, or is not yet capable from the attacker's seat → stay INVESTIGATING (chain it) or KILL \`insufficient_impact\`. Do **not** confirm "valid but non-applicable" findings.
 
 ---
 
-## 2. Adversarial Self-Review (Mandatory Before CONFIRMED)
-Before confirming any vulnerability, argue against yourself:
-1. Explain why this might NOT be a vulnerability (e.g. intended behavior, sandbox limit, misconfiguration).
-2. List alternative explanations for the observed behavior.
-3. Explain why each alternative was rejected.
-4. Describe what specific evidence disproves those alternatives.
+## 3. Adversarial Self-Review (Mandatory Before CONFIRMED)
+Argue against yourself:
+1. Why this might NOT be a vulnerability (intended, sandbox, misconfig, already authorized).
+2. Alternative explanations for the observation.
+3. Why each alternative was rejected **with evidence**.
+4. What blocks a real attacker today (auth, CSRF, network, role checks) and whether each is bypassed.
+5. Would a program triage say "informative / N/A" because impact is self-only or privileged-only?
 
 ---
 
-## 3. False Positive Audit Checklist
-Attempt to falsify the finding. Immediately KILL the case if any of the following apply:
-- The behavior matches intended or documented specs.
-- The issue is caused by browser quirks, testing mistakes, or cache artifacts.
-- Framework/middleware protections render it unexploitable in production.
-- Environmental limitations prevent crossing a security boundary.
+## 4. False Positive / Non-Applicable Kill Checklist
+KILL immediately when any apply:
+- Matches documented/spec behavior (\`intended_behavior\`)
+- Browser quirk, test artifact, or cache noise
+- Framework/middleware/WAF blocks the path and is not bypassed (\`framework_protection\`)
+- Requires privileges the attacker already has or cannot obtain (\`environmental_issue\`)
+- No C/I/A/financial effect for anyone but the attacker themselves (\`insufficient_impact\`)
+- Exploit unreliable / not reproducible twice (\`exploit_unreliable\`)
+- Duplicate of an existing case (\`duplicate\`)
 
 ---
 
-## 4. Root Cause Before Impact
-Do not map "Behavior → Impact". You must trace:
+## 5. Root Cause → Boundary → Impact (Not Behavior → Hype)
+Trace:
 \`\`\`
-Observed Behavior ──→ Root Cause ──→ Security Boundary Broken ──→ Actual Impact
+Entry (attacker-controlled) ──→ Reachable code path ──→ Trust boundary crossed ──→ Victim impact
 \`\`\`
-- Minimum confirmation: Must reproduce successfully at least twice or via two independent methods.
-- Document case details structured as: **Observed Facts**, **Assumptions**, **Unknowns**, **Experiments Remaining**.
+- Minimum: reproduce successfully at least twice or via two independent methods.
+- Record: **Observed Facts**, **Assumptions**, **Unknowns**, **Experiments Remaining**.
+- If the bug is only a **primitive** (e.g. open redirect, limited SSRF, info leak of non-sensitive data), either chain to high impact or keep severity honest — do not inflate.
 
 ---
 
-## 5. Duplicate Check
-Before creating any new case, ask:
-- Is this actually new?
-- Could it be another manifestation of an existing case?
-- Do multiple endpoints share the same underlying root cause?
-Keep the database clean; consolidate related endpoints into single root-cause cases.
+## 6. Duplicate Check
+Before CaseAdd:
+- Is this new?
+- Same root cause as an open case?
+- Multiple endpoints, one bug?
+Continue the existing case ID when scope matches.
 
 ---
 
-## 6. Report-Readiness Gate
-Before marking Ready for Report:
-- Can another researcher reproduce this deterministically?
-- Are the steps completely reproducible?
-- Is the impact justified without inflating severity? (Would the vendor agree with this impact? Is a real trust boundary crossed?)
-- Are exact root causes and remedial code changes detailed?
+## 7. Report-Readiness Gate
+Before REPORTED:
+- Another researcher can reproduce deterministically
+- Steps are complete and production-realistic
+- Impact is justified without inflation (would the vendor agree?)
+- Root cause and fix guidance are concrete
+- Attacker model + victim impact are explicit in the write-up
 
 ---
 
-## 7. Permanent KILLED Case Cataloging
-Keep killed cases documented with a clear classification in the ledger:
+## 8. Permanent KILLED Cataloging
+Keep killed reasons explicit in assumptions/blockers:
 - \`intended_behavior\`
 - \`duplicate\`
 - \`framework_protection\`
 - \`exploit_unreliable\`
 - \`insufficient_impact\`
 - \`environmental_issue\`
-Documenting why ideas were rejected prevents revisiting the same dead ends.
-`;
+- \`not_applicable\` (true bug / interesting behavior, no realistic attacker value)
+Documenting kills prevents re-opening dead ends.
+`.trim();
+
+function sanitizeContextText(v?: string, max = 160): string | undefined {
+  // biome-ignore lint/suspicious/noControlCharactersInRegex: strip C0 controls from untrusted case text
+  const controlChars = /[\r\n\t\u0000-\u001F\u007F\u2028\u2029]+/g;
+  const s = v
+    ?.replace(controlChars, " ")
+    .replace(/[<>]/g, (c) => (c === "<" ? "‹" : "›"))
+    .replace(/([\\`*_{}[\]()#+\-.!])/g, "\\$1")
+    .replace(/\s+/g, " ")
+    .trim();
+  return s ? (s.length > max ? `${s.slice(0, max - 1)}…` : s) : undefined;
+}
 
-function buildCaseContext(records: CaseRecord[]): string {
+/** Active-case ledger summary only (no workflow). Empty when nothing is open. */
+function buildCaseListContext(records: CaseRecord[]): string {
   if (records.length === 0) return "";
 
-  const safe = (v?: string, max = 160) => {
-    const controlChars = /[\r\n\t\u0000-\u001F\u007F\u2028\u2029]+/g;
-    const s = v
-      ?.replace(controlChars, " ")
-      .replace(/[<>]/g, (c) => (c === "<" ? "‹" : "›"))
-      .replace(/([\\`*_{}[\]()#+\-.!])/g, "\\$1")
-      .replace(/\s+/g, " ")
-      .trim();
-    return s ? (s.length > max ? `${s.slice(0, max - 1)}…` : s) : undefined;
-  };
-
   const count = (s: string) => records.filter((r) => r.status === s).length;
   const lines: string[] = [
     "<casefile_context>",
@@ -454,9 +514,11 @@ function buildCaseContext(records: CaseRecord[]): string {
     if (!subset.length) continue;
     lines.push(`  ${label}:`);
     for (const c of subset) {
-      const n = safe(c.nextStep, 180);
+      const n = sanitizeContextText(c.nextStep, 180);
       const extra = status === "confirmed" ? ` [${c.severity ?? "?"}]` : "";
-      lines.push(`  - ${c.id}: ${safe(c.title, 140) ?? "(untitled)"}${extra}${n ? ` → ${n}` : ""}`);
+      lines.push(
+        `  - ${c.id}: ${sanitizeContextText(c.title, 140) ?? "(untitled)"}${extra}${n ? ` → ${n}` : ""}`,
+      );
     }
   }
 
@@ -464,16 +526,22 @@ function buildCaseContext(records: CaseRecord[]): string {
   if (highPrio.length > 0) {
     lines.push("  High priority:");
     for (const c of highPrio) {
-      lines.push(`  - ${c.id}: ${safe(c.title, 140) ?? "(untitled)"} [${c.priority}]`);
+      lines.push(
+        `  - ${c.id}: ${sanitizeContextText(c.title, 140) ?? "(untitled)"} [${c.priority}]`,
+      );
     }
   }
 
   lines.push("</casefile_context>");
-  lines.push(STATIC_CYBER_WORKFLOW);
-
   return lines.join("\n");
 }
 
+/** Always includes cyber workflow; attaches case list when active cases exist. */
+function buildAgentInjection(active: CaseRecord[]): string {
+  const caseList = buildCaseListContext(active);
+  return caseList ? `${caseList}\n\n${STATIC_CYBER_WORKFLOW}` : STATIC_CYBER_WORKFLOW;
+}
+
 // ── Main extension ────────────────────────────────────────────────────
 
 export default function casefileExtension(pi: ExtensionAPI) {
@@ -650,6 +718,22 @@ export default function casefileExtension(pi: ExtensionAPI) {
 
     async execute(_id, params, _signal, _onUpdate, _ctx) {
       const run = runPoc(params.poc_path as string, params.local !== true);
+
+      // Fail closed without throwing: non-zero PoC must leave the case investigating.
+      if (run.exitCode !== 0) {
+        const record = getCaseById(params.id as string);
+        return {
+          content: [
+            {
+              type: "text",
+              text: `PoC failed (exit ${run.exitCode}). Case remains investigating.\nOutput:\n${run.output}`,
+            },
+          ],
+          isError: true,
+          details: { record, run },
+        };
+      }
+
       const result = promoteFindingResult(params.id as string, {
         path: run.path,
         exitCode: run.exitCode,
@@ -662,10 +746,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
         content: [
           {
             type: "text",
-            text:
-              run.exitCode === 0
-                ? `PoC verified (exit ${run.exitCode}). Case promoted to confirmed:\n${formatCaseDetail(record)}`
-                : `PoC failed (exit ${run.exitCode}). Case remains investigating.\nOutput:\n${run.output}`,
+            text: `PoC verified (exit ${run.exitCode}). Case promoted to confirmed:\n${formatCaseDetail(record)}`,
           },
         ],
         details: { record, run },
@@ -1024,22 +1105,23 @@ export default function casefileExtension(pi: ExtensionAPI) {
   // ── Event: Inject context into system prompt ──
 
   pi.on("before_agent_start", async () => {
+    // Once per user prompt (not every tool turn). Always inject workflow so empty
+    // ledgers still get attacker discipline; attach case list only when useful.
+    let active: CaseRecord[] = [];
     try {
       const records = readCasefile();
-      const active = records.filter((r) => r.status !== "killed" && r.status !== "reported");
-      if (active.length === 0) return;
-
-      const caseContext = buildCaseContext(active);
-      return {
-        message: {
-          customType: "casefile_summary",
-          content: caseContext,
-          display: false,
-        },
-      };
+      active = records.filter((r) => r.status !== "killed" && r.status !== "reported");
     } catch {
-      // No database yet
+      // No database yet — still inject workflow.
     }
+
+    return {
+      message: {
+        customType: "casefile_summary",
+        content: buildAgentInjection(active),
+        display: false,
+      },
+    };
   });
 
   // ── Event: Update status bar ──

package/src/ledger.ts

@@ -419,14 +419,21 @@ function validateTransition(
   if (to === "blocked") return;
 
   type Rule = (u: CaseUpdate, current?: CaseRecord) => string | null;
+
+  // Transition rules must consult both the update payload AND the current record.
+  // Agents often promote status alone after evidence was already written in a prior update.
+  const requireInvestigatingFields: Rule = (u, cur) => {
+    // Normalize so whitespace-only evidence cannot satisfy the gate.
+    const evidence = normalizeText(u.evidence ?? cur?.evidence);
+    const confidence = u.confidence ?? cur?.confidence;
+    if (!evidence) return "INVESTIGATING requires evidence (source→sink trace)";
+    if (!confidence) return "INVESTIGATING requires confidence level";
+    return null;
+  };
+
   const transitions: Partial<Record<CaseStatus, Partial<Record<CaseStatus, Rule>>>> = {
     hypothesis: {
-      investigating: (u) =>
-        !u.evidence
-          ? "INVESTIGATING requires evidence (source→sink trace)"
-          : !u.confidence
-            ? "INVESTIGATING requires confidence level"
-            : null,
+      investigating: requireInvestigatingFields,
       confirmed: () => "Cannot jump hypothesis → confirmed; promote to investigating first",
       reported: () => "Cannot jump hypothesis → reported; confirm first",
     },
@@ -443,12 +450,7 @@ function validateTransition(
       investigating: () => null,
     },
     blocked: {
-      investigating: (u) =>
-        !u.evidence
-          ? "INVESTIGATING requires evidence (source→sink trace)"
-          : !u.confidence
-            ? "INVESTIGATING requires confidence level"
-            : null,
+      investigating: requireInvestigatingFields,
       hypothesis: () => null,
     },
   };
@@ -514,7 +516,11 @@ function buildRecord(input: NormalizedCaseInput, existing?: CaseRecord): CaseRec
   };
 }
 
-function findDuplicateCaseInDb(db: DatabaseSync, candidate: CaseRecord): CaseRecord | undefined {
+function findDuplicateCaseInDb(
+  db: DatabaseSync,
+  candidate: Pick<CaseRecord, "title" | "target" | "endpoint" | "bugClass">,
+  excludeId?: string,
+): CaseRecord | undefined {
   const title = normalizeMatchText(candidate.title);
   if (!title) return undefined;
 
@@ -522,9 +528,12 @@ function findDuplicateCaseInDb(db: DatabaseSync, candidate: CaseRecord): CaseRec
   const endpoint = normalizeMatchText(candidate.endpoint);
   const bugClass = normalizeMatchText(candidate.bugClass);
 
-  // We query all cases where status is not killed, then match in JS for normalized forms
-  const stmt = db.prepare("SELECT * FROM cases WHERE status != 'killed'");
-  const rows = stmt.all();
+  // Query non-killed cases, then match normalized title/scope in JS.
+  const rows = excludeId
+    ? (db
+        .prepare("SELECT * FROM cases WHERE status != 'killed' AND id != ?")
+        .all(excludeId) as any[])
+    : (db.prepare("SELECT * FROM cases WHERE status != 'killed'").all() as any[]);
 
   for (const row of rows) {
     if (
@@ -533,9 +542,9 @@ function findDuplicateCaseInDb(db: DatabaseSync, candidate: CaseRecord): CaseRec
       normalizeMatchText(row.endpoint as string) === endpoint &&
       normalizeMatchText(row.bugClass as string) === bugClass
     ) {
-      // Find links
-      const linkStmt = db.prepare("SELECT target_id FROM case_links WHERE source_id = ?");
-      const links = linkStmt.all(row.id) as { target_id: string }[];
+      const links = db
+        .prepare("SELECT target_id FROM case_links WHERE source_id = ?")
+        .all(row.id) as { target_id: string }[];
       return mapRow(
         row,
         links.map((l) => l.target_id),
@@ -547,9 +556,11 @@ function findDuplicateCaseInDb(db: DatabaseSync, candidate: CaseRecord): CaseRec
 
 // ── SQLite Mutation Actions ───────────────────────────────────────────
 
-function insertOrReplaceCase(db: DatabaseSync, record: CaseRecord) {
+function upsertCase(db: DatabaseSync, record: CaseRecord) {
+  // Use ON CONFLICT DO UPDATE (not INSERT OR REPLACE) so FK CASCADE does not
+  // wipe case_links when updating an existing primary key.
   const stmt = db.prepare(`
-    INSERT OR REPLACE INTO cases (
+    INSERT INTO cases (
       id, title, status, confidence, severity, priority, target, endpoint, bugClass,
       summary, evidence, impact, nextStep, poc, remediation,
       references_json, blockers_json, tags_json, assumptions_json, poc_verified_json,
@@ -560,6 +571,30 @@ function insertOrReplaceCase(db: DatabaseSync, record: CaseRecord) {
       ?, ?, ?, ?, ?,
       ?, ?, ?, ?
     )
+    ON CONFLICT(id) DO UPDATE SET
+      title = excluded.title,
+      status = excluded.status,
+      confidence = excluded.confidence,
+      severity = excluded.severity,
+      priority = excluded.priority,
+      target = excluded.target,
+      endpoint = excluded.endpoint,
+      bugClass = excluded.bugClass,
+      summary = excluded.summary,
+      evidence = excluded.evidence,
+      impact = excluded.impact,
+      nextStep = excluded.nextStep,
+      poc = excluded.poc,
+      remediation = excluded.remediation,
+      references_json = excluded.references_json,
+      blockers_json = excluded.blockers_json,
+      tags_json = excluded.tags_json,
+      assumptions_json = excluded.assumptions_json,
+      poc_verified_json = excluded.poc_verified_json,
+      reported_at = excluded.reported_at,
+      report_path = excluded.report_path,
+      created_at = excluded.created_at,
+      updated_at = excluded.updated_at
   `);
 
   stmt.run(
@@ -606,7 +641,7 @@ export function addCaseResult(input: CaseInput): CaseAddResult {
     };
   }
 
-  insertOrReplaceCase(db, record);
+  upsertCase(db, record);
   return { record, created: true };
 }
 
@@ -617,6 +652,16 @@ export function updateCaseResult(id: string, update: CaseUpdate): CaseUpdateResu
     throw new Error(`Case not found: ${id}`);
   }
 
+  // Terminal states: block all mutations (status and field edits). The transition
+  // gate only runs on status changes, so without this reported/killed cases could
+  // still be rewritten via field-only updates.
+  if (current.status === "killed") {
+    throw new Error("Cannot mutate a killed case; open a new case if the lead is revived");
+  }
+  if (current.status === "reported") {
+    throw new Error("Cannot mutate a reported case; file a follow-up case instead");
+  }
+
   const optionalFields = [
     "title",
     "target",
@@ -636,7 +681,7 @@ export function updateCaseResult(id: string, update: CaseUpdate): CaseUpdateResu
     }
   }
 
-  const next = buildRecord(
+  let next = buildRecord(
     {
       ...optionalPatch,
       status: update.status ?? current.status,
@@ -654,6 +699,12 @@ export function updateCaseResult(id: string, update: CaseUpdate): CaseUpdateResu
   if (update.status && update.status !== current.status) {
     validateTransition(current.status, next.status, update, current);
   }
+
+  // Demoting off confirmed invalidates prior PoC verification — re-promote required.
+  if (current.status === "confirmed" && next.status === "investigating") {
+    next = { ...next, pocVerified: undefined };
+  }
+
   validateCase(next);
 
   // Check material equality (we ignore links since links are mutated via CaseLink)
@@ -667,32 +718,7 @@ export function updateCaseResult(id: string, update: CaseUpdate): CaseUpdateResu
     return { record: current, changed: false, reason };
   }
 
-  // Duplicate checks excluding current
-  const title = normalizeMatchText(next.title);
-  const target = normalizeMatchText(next.target);
-  const endpoint = normalizeMatchText(next.endpoint);
-  const bugClass = normalizeMatchText(next.bugClass);
-
-  const stmt = db.prepare("SELECT * FROM cases WHERE status != 'killed' AND id != ?");
-  const rows = stmt.all(id);
-  let duplicate: CaseRecord | undefined;
-  for (const row of rows) {
-    if (
-      normalizeMatchText(row.title as string) === title &&
-      normalizeMatchText(row.target as string) === target &&
-      normalizeMatchText(row.endpoint as string) === endpoint &&
-      normalizeMatchText(row.bugClass as string) === bugClass
-    ) {
-      const linkStmt = db.prepare("SELECT target_id FROM case_links WHERE source_id = ?");
-      const links = linkStmt.all(row.id) as { target_id: string }[];
-      duplicate = mapRow(
-        row,
-        links.map((l) => l.target_id),
-      );
-      break;
-    }
-  }
-
+  const duplicate = findDuplicateCaseInDb(db, next, id);
   if (duplicate) {
     return {
       record: current,
@@ -701,7 +727,7 @@ export function updateCaseResult(id: string, update: CaseUpdate): CaseUpdateResu
     };
   }
 
-  insertOrReplaceCase(db, next);
+  upsertCase(db, next);
   return { record: next, changed: true };
 }
 
@@ -757,7 +783,7 @@ export function promoteFindingResult(id: string, verification: PocVerification):
   );
   validateCase(next);
 
-  insertOrReplaceCase(db, next);
+  upsertCase(db, next);
   return { record: next, changed: true };
 }
 
@@ -772,6 +798,12 @@ export function linkCasesResult(sourceId: string, targetId: string): CaseLinkRes
   const target = getCaseById(targetId);
   if (!source) throw new Error(`Case not found: ${sourceId}`);
   if (!target) throw new Error(`Case not found: ${targetId}`);
+  if (source.status === "killed" || source.status === "reported") {
+    throw new Error(`Cannot link terminal case ${sourceId} (${source.status})`);
+  }
+  if (target.status === "killed" || target.status === "reported") {
+    throw new Error(`Cannot link terminal case ${targetId} (${target.status})`);
+  }
 
   const checkStmt = db.prepare("SELECT 1 FROM case_links WHERE source_id = ? AND target_id = ?");
   const exists = checkStmt.get(sourceId, targetId);
@@ -781,14 +813,25 @@ export function linkCasesResult(sourceId: string, targetId: string): CaseLinkRes
   }
 
   // Atomic insert both directions into junction table
-  const linkStmt = db.prepare("INSERT INTO case_links (source_id, target_id) VALUES (?, ?)");
-  linkStmt.run(sourceId, targetId);
-  linkStmt.run(targetId, sourceId);
-
-  const now = new Date().toISOString();
-  const updateTimeStmt = db.prepare("UPDATE cases SET updated_at = ? WHERE id = ?");
-  updateTimeStmt.run(now, sourceId);
-  updateTimeStmt.run(now, targetId);
+  db.exec("BEGIN");
+  try {
+    const linkStmt = db.prepare("INSERT INTO case_links (source_id, target_id) VALUES (?, ?)");
+    linkStmt.run(sourceId, targetId);
+    linkStmt.run(targetId, sourceId);
+
+    const now = new Date().toISOString();
+    const updateTimeStmt = db.prepare("UPDATE cases SET updated_at = ? WHERE id = ?");
+    updateTimeStmt.run(now, sourceId);
+    updateTimeStmt.run(now, targetId);
+    db.exec("COMMIT");
+  } catch (err) {
+    try {
+      db.exec("ROLLBACK");
+    } catch {
+      // ignore
+    }
+    throw err;
+  }
 
   const finalSource = getCaseById(sourceId)!;
   const finalTarget = getCaseById(targetId)!;
@@ -801,6 +844,12 @@ export function unlinkCasesResult(sourceId: string, targetId: string): CaseLinkR
   const target = getCaseById(targetId);
   if (!source) throw new Error(`Case not found: ${sourceId}`);
   if (!target) throw new Error(`Case not found: ${targetId}`);
+  if (source.status === "killed" || source.status === "reported") {
+    throw new Error(`Cannot unlink terminal case ${sourceId} (${source.status})`);
+  }
+  if (target.status === "killed" || target.status === "reported") {
+    throw new Error(`Cannot unlink terminal case ${targetId} (${target.status})`);
+  }
 
   const checkStmt = db.prepare("SELECT 1 FROM case_links WHERE source_id = ? AND target_id = ?");
   const exists = checkStmt.get(sourceId, targetId);
@@ -809,15 +858,26 @@ export function unlinkCasesResult(sourceId: string, targetId: string): CaseLinkR
     return { source, target, changed: false, reason: "Cases are not linked" };
   }
 
-  const unlinkStmt = db.prepare(
-    "DELETE FROM case_links WHERE (source_id = ? AND target_id = ?) OR (source_id = ? AND target_id = ?)",
-  );
-  unlinkStmt.run(sourceId, targetId, targetId, sourceId);
-
-  const now = new Date().toISOString();
-  const updateTimeStmt = db.prepare("UPDATE cases SET updated_at = ? WHERE id = ?");
-  updateTimeStmt.run(now, sourceId);
-  updateTimeStmt.run(now, targetId);
+  db.exec("BEGIN");
+  try {
+    const unlinkStmt = db.prepare(
+      "DELETE FROM case_links WHERE (source_id = ? AND target_id = ?) OR (source_id = ? AND target_id = ?)",
+    );
+    unlinkStmt.run(sourceId, targetId, targetId, sourceId);
+
+    const now = new Date().toISOString();
+    const updateTimeStmt = db.prepare("UPDATE cases SET updated_at = ? WHERE id = ?");
+    updateTimeStmt.run(now, sourceId);
+    updateTimeStmt.run(now, targetId);
+    db.exec("COMMIT");
+  } catch (err) {
+    try {
+      db.exec("ROLLBACK");
+    } catch {
+      // ignore
+    }
+    throw err;
+  }
 
   const finalSource = getCaseById(sourceId)!;
   const finalTarget = getCaseById(targetId)!;
@@ -1039,6 +1099,11 @@ export function writeCaseReport(id: string): { path: string; record: CaseRecord
     throw new Error("Case reports require a confirmed or reported case");
   }
 
+  // Reported cases are terminal artifacts — return the existing report path if present.
+  if (current.status === "reported" && current.reportPath && existsSync(current.reportPath)) {
+    return { path: current.reportPath, record: current };
+  }
+
   const db = getDb();
   const dbPath = getCasefilePath();
 
@@ -1094,6 +1159,6 @@ export function writeCaseReport(id: string): { path: string; record: CaseRecord
     updatedAt: new Date().toISOString(),
   };
 
-  insertOrReplaceCase(db, next);
+  upsertCase(db, next);
   return { path: reportPath, record: next };
 }

package/src/poc-runner.ts

@@ -1,7 +1,7 @@
 import { spawnSync } from "node:child_process";
 import { copyFileSync, existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename, dirname, extname, isAbsolute, join, resolve } from "node:path";
+import { basename, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
 
 export type PocRun = {
   path: string;
@@ -145,18 +145,18 @@ function resolveLanguage(pocPath: string): { key: string; language: PocLanguage
     if (shebangKey) return { key: shebangKey, language: languages[shebangKey] };
   }
 
-  // 2. Project type detection.
+  // 2. Extension-based language (prefer the PoC file itself over ambient project markers).
+  // A .py PoC in a Node monorepo must still run under python, not node.
+  if (extKey && languages[extKey]) {
+    return { key: extKey, language: languages[extKey] };
+  }
+
+  // 3. Project type detection only when the extension is unknown/unmapped.
   const projectType = detectProjectType(languages);
   if (projectType && languages[projectType]) {
-    // If the file extension matches the project type or type has no extension restrictions, use it.
     return { key: projectType, language: languages[projectType] };
   }
 
-  // 3. Extension-based fallback.
-  if (extKey && languages[extKey]) {
-    return { key: extKey, language: languages[extKey] };
-  }
-
   // 4. Unknown extension: allow env override specifying a single language key.
   const envDefault = process.env.PI_POC_DEFAULT_LANGUAGE?.trim();
   if (envDefault && languages[envDefault]) {
@@ -186,13 +186,12 @@ function validatePocPath(pocPath: string): string {
     throw new Error("PoC path contains null bytes");
   }
 
-  const parts = normalized.split(/[\\/]/);
-  if (parts.includes("..")) {
-    throw new Error(`PoC path contains traversal segments: ${pocPath}`);
-  }
-
   const root = getProjectRoot();
-  if (!normalized.startsWith(`${root}/`) && normalized !== root) {
+  // Use path.relative so prefix-sibling escapes like /tmp/proj vs /tmp/proj-evil are rejected.
+  // startsWith(`${root}/`) would accept /tmp/proj-evil when root is /tmp/proj.
+  const rel = relative(root, normalized);
+  const outsideWorkspace = rel === "" ? false : rel.startsWith("..") || isAbsolute(rel);
+  if (outsideWorkspace) {
     const allowAbsolute = process.env.PI_POC_ALLOW_ABSOLUTE === "1";
     if (!allowAbsolute) {
       throw new Error(