@xaccefy/pi-casefile 0.7.0 → 0.7.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xaccefy/pi-casefile",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Offensive security case tracker for Pi Agent — bug bounties, CTFs, security audits",
   "keywords": [
     "pi-package",
@@ -35,6 +35,7 @@
     "src/ledger.ts",
     "src/workflow.ts",
     "src/poc-runner.ts",
+    "src/pipeline-submit.ts",
     "src/scratchpad.ts",
     "src/sqlite-compat/index.ts",
     "skills",

package/src/index.ts

@@ -1,13 +1,12 @@
 /**
  * Casefile — offensive security case tracker for Pi.
  *
- * Tools: CaseAdd, CaseUpdate, PromoteFinding, CaseGet, CaseList, CaseSearch, CaseLink, CaseUnlink, CaseReport, ScratchpadInit, ScratchpadResume, ScratchpadCheckpoint, ScratchpadWrite, ScratchpadRead, ScratchpadPhaseDone, ScratchpadClear
+ * Tools: CaseAdd, CaseUpdate, PromoteFinding, CaseGet, CaseList, CaseSearch, CaseLink, CaseUnlink, CaseReport, PipelineSubmit, ScratchpadInit, ScratchpadResume, ScratchpadCheckpoint, ScratchpadWrite, ScratchpadRead, ScratchpadPhaseDone, ScratchpadClear
  * Command: /casefile — interactive dashboard
- * Event: before_agent_start — injects cyber workflow (+ active case list) once per user prompt
+ * Event: before_agent_start — injects cyber workflow once per session, refreshes the active case list per prompt
  */
 
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { matchesKey, Text, truncateToWidth } from "@earendil-works/pi-tui";
@@ -45,6 +44,7 @@ import {
   updateCaseResult,
   writeCaseReport,
 } from "./ledger.ts";
+import { pipeline_submit, SUBMIT_STAGES, type SubmitStage } from "./pipeline-submit.ts";
 import { type PocRun, runPoc } from "./poc-runner.ts";
 import {
   type ScratchpadPhase,
@@ -122,6 +122,11 @@ const PromoteSchema = Type.Object(
     poc_path: Type.String({
       description: "Absolute path to the PoC script on disk",
     }),
+    verification_marker: Type.String({
+      minLength: 1,
+      description:
+        "A unique string the PoC must print to stdout to prove exploitation actually occurred. The gate checks the PoC output contains this marker — exit code 0 alone is NOT sufficient. The marker should be specific to the finding (e.g. 'VULN_CONFIRMED_<case-id>') and only printed after the PoC has verified the exploit worked (e.g. after extracting data, receiving a callback, seeing the payload reflected). This prevents fluke exit 0 and mocked PoCs from passing the gate.",
+    }),
     disconfirmation_path: Type.Optional(
       Type.String({
         description:
@@ -248,7 +253,8 @@ const SCRATCHPAD_PHASES = [
 
 const ScratchpadPhaseSchema = Type.String({
   enum: [...SCRATCHPAD_PHASES],
-  description: "Pipeline phase: recon | hunt | gapfil | trace | skeptic | validate | chain | patch | report",
+  description:
+    "Pipeline phase: recon | hunt | gapfil | trace | skeptic | validate | chain | patch | report",
 });
 
 const ScratchpadInitSchema = Type.Object(
@@ -269,7 +275,11 @@ const ScratchpadCheckpointSchema = Type.Object(
   {
     run_id: Type.String({ description: "Run identifier" }),
     phase: ScratchpadPhaseSchema,
-    ids: Type.Optional(Type.Array(Type.String(), { description: "Key IDs produced by this phase (case IDs, finding IDs)" })),
+    ids: Type.Optional(
+      Type.Array(Type.String(), {
+        description: "Key IDs produced by this phase (case IDs, finding IDs)",
+      }),
+    ),
     summary: Type.Optional(Type.String({ description: "One-line summary of phase completion" })),
   },
   { additionalProperties: false },
@@ -279,7 +289,9 @@ const ScratchpadWriteSchema = Type.Object(
   {
     run_id: Type.String({ description: "Run identifier" }),
     phase: ScratchpadPhaseSchema,
-    artifact_name: Type.String({ description: "Artifact filename (sanitized; path traversal is blocked)" }),
+    artifact_name: Type.String({
+      description: "Artifact filename (sanitized; path traversal is blocked)",
+    }),
     content: Type.String({ description: "Artifact content to write" }),
   },
   { additionalProperties: false },
@@ -415,9 +427,7 @@ class CasefileDashboard {
 
     if (this.records.length === 0) {
       lines.push("");
-      lines.push(
-        `  ${th.fg("dim", "No active security cases. Ask the agent to CaseAdd findings!")}`,
-      );
+      lines.push(`  ${th.fg("dim", "No security cases yet. Ask the agent to CaseAdd findings!")}`);
     } else {
       lines.push("");
       for (const r of this.records) {
@@ -502,9 +512,15 @@ function buildCaseListContext(records: CaseRecord[]): string {
   return lines.join("\n");
 }
 
-/** Always includes cyber workflow; attaches case list when active cases exist. */
-function buildAgentInjection(active: CaseRecord[]): string {
+/**
+ * Builds the per-prompt injection. The cyber workflow is session-scope data —
+ * it never changes — so the caller passes includeWorkflow=true exactly once
+ * per session; re-injecting it on every prompt is pure token cost. The active
+ * case list DOES change as cases are added, so it is refreshed every prompt.
+ */
+function buildAgentInjection(active: CaseRecord[], includeWorkflow: boolean): string {
   const caseList = buildCaseListContext(active);
+  if (!includeWorkflow) return caseList;
   // Workflow FIRST for prominence, then case list as reference data.
   return caseList ? `${STATIC_CYBER_WORKFLOW}\n\n${caseList}` : STATIC_CYBER_WORKFLOW;
 }
@@ -520,11 +536,7 @@ export const XP_MODE_ENV = "PI_XP_MODE";
 export type XpMode = "on" | "off";
 
 export function getXpModeStatePath(): string {
-  try {
-    return join(dirname(getCasefilePath()), "xp-mode");
-  } catch {
-    return join(homedir(), ".pi", "xp-mode");
-  }
+  return join(dirname(getCasefilePath()), "xp-mode");
 }
 
 export function readXpMode(
@@ -724,13 +736,14 @@ export default function casefileExtension(pi: ExtensionAPI) {
     name: "PromoteFinding",
     label: "Promote Finding",
     description:
-      "Run an on-disk PoC script (Docker sandbox or local) and, on exit 0, promote an investigating case to confirmed. Optionally run a disconfirmation script that must exit non-0 (finding survived the attempt to disprove).",
+      "Run an on-disk PoC script (Docker sandbox or local) and, on exit 0 + verification marker present in output, promote an investigating case to confirmed. The verification_marker proves the exploit actually worked — exit code 0 alone is NOT sufficient. Optionally run a disconfirmation script that must exit non-0 (finding survived the attempt to disprove).",
     promptSnippet: "Run a PoC and promote an investigating case to confirmed",
     promptGuidelines: [
       "Use PromoteFinding when an investigating case has a concrete PoC script on disk and you are ready to prove it.",
       "The case must already have status='investigating' and non-empty poc, evidence, impact, severity, target, and disconfirmation fields.",
       "By default, the PoC runs in `docker run --rm --network none`. Use local:true to run on the host (e.g. for network-dependent bugs).",
-      "Only exit code 0 promotes the case to confirmed.",
+      "Promotion requires BOTH exit code 0 AND the verification_marker appearing in the PoC output. The marker is a string you choose (e.g. 'VULN_CONFIRMED_<case-id>') that the PoC prints ONLY after it has verified the exploit worked — after extracting data, receiving a callback, seeing the payload reflected, etc. Do NOT print the marker unconditionally or before the exploit check.",
+      "The marker check prevents fluke exit 0 (script crashed before real logic) and mocked PoCs (script ran but didn't actually exploit the target) from passing the gate.",
       "Optionally provide disconfirmation_path to a script that tries to disprove the finding. If the disconfirmation script exits 0, the finding is considered disproven and promotion is blocked.",
       "Do not use CaseUpdate to set status='confirmed' directly — it is rejected. Always use PromoteFinding.",
     ],
@@ -741,6 +754,26 @@ export default function casefileExtension(pi: ExtensionAPI) {
       // 30s (plus first-time image pull), so fail cheap when the case can't
       // advance anyway (missing, wrong status, missing required fields).
       assertPromotable(params.id as string);
+
+      // Reject empty/whitespace markers BEFORE any PoC run — it's a param
+      // error, so fail cheap instead of burning a (up to 30s) sandboxed run.
+      const marker = (params.verification_marker as string | undefined)?.trim();
+      if (!marker) {
+        return {
+          content: [
+            {
+              type: "text",
+              text:
+                "verification_marker is empty or whitespace. " +
+                "A non-empty marker printed only AFTER the PoC confirms exploitation is required — " +
+                "exit code 0 alone is not sufficient. Case remains investigating.",
+            },
+          ],
+          isError: true,
+          details: { record: getCaseById(params.id as string) },
+        };
+      }
+
       const run = runPoc(params.poc_path as string, params.local !== true);
 
       // Fail closed without throwing: non-zero PoC must leave the case investigating.
@@ -758,6 +791,28 @@ export default function casefileExtension(pi: ExtensionAPI) {
         };
       }
 
+      // Verification marker check: exit code 0 alone is NOT sufficient.
+      // The PoC must print the verification_marker to stdout, proving the
+      // exploit actually worked — not just that the script ran. This blocks
+      // fluke exit 0 (crash before real logic) and mocked PoCs that don't
+      // actually exploit the target.
+      if (!(run.output ?? "").includes(marker)) {
+        const record = getCaseById(params.id as string);
+        return {
+          content: [
+            {
+              type: "text",
+              text:
+                `PoC exited 0 but the verification marker "${marker}" was NOT found in the output.\n` +
+                `This means the script ran but did not prove exploitation. The marker must be printed only AFTER the PoC verifies the exploit worked (data extracted, callback received, payload reflected, etc.).\n` +
+                `Do not print the marker unconditionally — print it only when the exploit is confirmed.\n\nOutput:\n${run.output}`,
+            },
+          ],
+          isError: true,
+          details: { record, run, markerMissing: true },
+        };
+      }
+
       // Run disconfirmation script if provided — must exit NON-0 (finding survived the attempt to disprove).
       let disconfirmationRun: PocRun | undefined;
       if (params.disconfirmation_path) {
@@ -1105,7 +1160,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
     name: "CaseReport",
     label: "Write Case Report",
     description:
-      "Generate a markdown report from a confirmed or reported case under the project report directory. Hypothesis/investigating/blocked/killed cases are rejected — promote to confirmed first.",
+      "Generate a markdown report from a confirmed or reported case under the casefile report directory (next to the casefile DB). Hypothesis/investigating/blocked/killed cases are rejected — promote to confirmed first.",
     promptSnippet: "Generate a bounty-style markdown report from a case",
     promptGuidelines: [
       "Use CaseReport only for confirmed or already reported cases. Keep hypotheses and investigating cases in the ledger until proof is captured.",
@@ -1159,6 +1214,80 @@ export default function casefileExtension(pi: ExtensionAPI) {
     },
   });
 
+  // ── Tool: PipelineSubmit ──
+
+  pi.registerTool({
+    name: "PipelineSubmit",
+    label: "Submit Stage Output",
+    description:
+      "Submit a pipeline stage's output (hunt, trace, skeptic, validate, chain, report) through the validation gate. Validates required fields against the stage spec (mirrors schemas/*.json), applies the deterministic pre-filter (test-path and file-existence filters on hunt findings, trivial dedup by file+class+line), and counts repair attempts (max 2, then rejected). A stage cannot advance on an invalid output — submit fixed output until accepted.",
+    promptSnippet: "Validate and submit a pipeline stage's output",
+    promptGuidelines: [
+      "Every stage output a subagent returns must go through PipelineSubmit before the next stage is dispatched. Do not eyeball schemas.",
+      "If the verdict is repair, fix the fields listed in errors and re-submit the same output. The repair budget is 2 attempts per finding — after that the submission is rejected and the stage is failed.",
+      "Unhandled skeptic output: an unparseable or schema-invalid skeptic response is UNDETERMINED, never DISPROVEN. A tracer error is UNREACHABLE. PipelineSubmit returns repair for these instead of accepting them.",
+      "Test-path findings and hallucinated files are rejected by the pre-filter, not repairable — the finding itself is noise.",
+    ],
+    parameters: Type.Object(
+      {
+        run_id: Type.String({
+          description: "Pipeline run identifier (same as the scratchpad run_id)",
+        }),
+        stage: Type.String({
+          enum: [...SUBMIT_STAGES],
+          description: "Pipeline stage: hunt | trace | skeptic | validate | chain | report",
+        }),
+        output: Type.Union([Type.String(), Type.Object({}, { additionalProperties: true })], {
+          description: "The stage output as a JSON object or JSON string (code fences tolerated)",
+        }),
+      },
+      { additionalProperties: false },
+    ),
+
+    async execute(_id, params, _signal, _onUpdate, _ctx) {
+      const result = pipeline_submit(
+        params.run_id as string,
+        params.stage as SubmitStage,
+        params.output,
+      );
+      const statusLine =
+        result.verdict === "accepted"
+          ? `ACCEPTED (${params.stage}) — artifact: ${result.artifact}`
+          : result.verdict === "repair"
+            ? `REPAIR (attempt ${result.repair_attempt}/2) — fix these and re-submit:\n  - ${result.errors.join("\n  - ")}`
+            : `REJECTED — ${result.errors.join("\n")}`;
+      return {
+        content: [{ type: "text", text: statusLine }],
+        isError: result.verdict !== "accepted",
+        details: result as unknown as Record<string, unknown>,
+      };
+    },
+
+    renderCall(args, theme) {
+      return new Text(
+        theme.fg("toolTitle", theme.bold("PipelineSubmit ")) +
+          theme.fg("dim", `${args.stage ?? ""}`),
+        0,
+        0,
+      );
+    },
+
+    renderResult(result, _opts, theme) {
+      const details = result.details as { verdict?: string; repair_attempt?: number } | undefined;
+      if (details?.verdict === "accepted") {
+        return new Text(theme.fg("success", "✓ PipelineSubmit accepted"), 0, 0);
+      }
+      if (details?.verdict === "repair") {
+        return new Text(
+          theme.fg("warning", `↷ PipelineSubmit repair ${details.repair_attempt}/2`),
+          0,
+          0,
+        );
+      }
+      return new Text(theme.fg("error", "✗ PipelineSubmit rejected"), 0, 0);
+    },
+  });
+
   // ── Tool: ScratchpadInit ──
 
   pi.registerTool({
@@ -1180,7 +1309,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
         content: [
           {
             type: "text",
-            text: `Scratchpad initialized for run ${cp.run_id}.\nCompleted phases: ${cp.completed_phases.length ? cp.completed_phases.join(", ") : "none"}\nDone: ${cp.done}`,
+            text: `Scratchpad initialized for run ${cp.run_id}.\nCompleted phases: ${cp.completed_phases.length ? cp.completed_phases.join(", ") : "none"}`,
           },
         ],
         details: { checkpoint: cp },
@@ -1197,13 +1326,8 @@ export default function casefileExtension(pi: ExtensionAPI) {
     },
 
     renderResult(result, _opts, theme) {
-      const cp = (result.details as { checkpoint: { run_id: string; done: boolean } } | undefined)?.checkpoint;
-      return new Text(
-        theme.fg("success", "✓ ") +
-          `ScratchpadInit ${cp?.run_id ?? ""}${cp?.done ? " (done)" : ""}`,
-        0,
-        0,
-      );
+      const cp = (result.details as { checkpoint: { run_id: string } } | undefined)?.checkpoint;
+      return new Text(`${theme.fg("success", "✓ ")}ScratchpadInit ${cp?.run_id ?? ""}`, 0, 0);
     },
   });
 
@@ -1243,8 +1367,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
             text:
               `Resume run ${cp.run_id}:\n` +
               `Completed phases: ${cp.completed_phases.length ? cp.completed_phases.join(", ") : "none"}\n` +
-              `Next phase: ${resume.next_phase ?? "none (run is done)"}\n` +
-              `Done: ${cp.done}`,
+              `Next phase: ${resume.next_phase ?? "none (run is done)"}`,
           },
         ],
         details: { resume },
@@ -1288,11 +1411,10 @@ export default function casefileExtension(pi: ExtensionAPI) {
     parameters: ScratchpadCheckpointSchema,
 
     async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const cp = scratchpad_checkpoint(
-        params.run_id as string,
-        params.phase as ScratchpadPhase,
-        { ids: params.ids as string[] | undefined, summary: params.summary as string | undefined },
-      );
+      const cp = scratchpad_checkpoint(params.run_id as string, params.phase as ScratchpadPhase, {
+        ids: params.ids as string[] | undefined,
+        summary: params.summary as string | undefined,
+      });
       return {
         content: [
           {
@@ -1316,7 +1438,9 @@ export default function casefileExtension(pi: ExtensionAPI) {
     },
 
     renderResult(result, _opts, theme) {
-      const cp = (result.details as { checkpoint: { run_id: string; completed_phases: string[] } } | undefined)?.checkpoint;
+      const cp = (
+        result.details as { checkpoint: { run_id: string; completed_phases: string[] } } | undefined
+      )?.checkpoint;
       return new Text(
         theme.fg("success", "✓ ") +
           `ScratchpadCheckpoint ${cp?.run_id ?? ""} — ${cp?.completed_phases.length ?? 0} phases done`,
@@ -1422,7 +1546,9 @@ export default function casefileExtension(pi: ExtensionAPI) {
     renderResult(result, _opts, theme) {
       const found = (result.details as { found?: boolean } | undefined)?.found;
       return new Text(
-        found ? theme.fg("success", "✓ ScratchpadRead") : theme.fg("warning", "↷ ScratchpadRead — not found"),
+        found
+          ? theme.fg("success", "✓ ScratchpadRead")
+          : theme.fg("warning", "↷ ScratchpadRead — not found"),
         0,
         0,
       );
@@ -1444,10 +1570,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
     parameters: ScratchpadPhaseDoneSchema,
 
     async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const done = scratchpad_phase_done(
-        params.run_id as string,
-        params.phase as ScratchpadPhase,
-      );
+      const done = scratchpad_phase_done(params.run_id as string, params.phase as ScratchpadPhase);
       return {
         content: [
           {
@@ -1471,7 +1594,9 @@ export default function casefileExtension(pi: ExtensionAPI) {
     renderResult(result, _opts, theme) {
       const done = (result.details as { done?: boolean } | undefined)?.done;
       return new Text(
-        done ? theme.fg("success", "✓ ScratchpadPhaseDone — done") : theme.fg("warning", "↷ ScratchpadPhaseDone — not done"),
+        done
+          ? theme.fg("success", "✓ ScratchpadPhaseDone — done")
+          : theme.fg("warning", "↷ ScratchpadPhaseDone — not done"),
         0,
         0,
       );
@@ -1555,13 +1680,22 @@ export default function casefileExtension(pi: ExtensionAPI) {
 
   // ── Event: Inject cyber workflow into system prompt ──
   // XP (offensive) mode is OFF by default so normal dev work stays quiet.
-  // Only when enabled do we inject the cyber workflow (and case list) into
-  // the system prompt each turn. Injecting into event.systemPrompt (not as a
-  // conversation message) makes the attacker mindset immediate and avoids
-  // session bloat from repeated message entries.
+  // When enabled, the cyber workflow is injected ONCE per session (first
+  // prompt); the active case list refreshes every prompt because it changes
+  // as cases are added. Injecting into event.systemPrompt (not as a
+  // conversation message) avoids session bloat from repeated message entries.
+  let workflowInjected = false;
 
   pi.on("before_agent_start", async (event) => {
     if (readXpMode() === "off") return;
+    // Skip subagent child processes: pi-subagents runs each child in its own
+    // pi process (PI_SUBAGENT_CHILD=1) with this extension loaded. Injecting
+    // the workflow + entire active-case ledger into every child dispatch is a
+    // token multiplier (N subagents × workflow + growing case list per turn) —
+    // workers get what they need via their task and tool guidelines.
+    if (process.env.PI_SUBAGENT_CHILD === "1") return;
+
+    const includeWorkflow = !workflowInjected;
 
     let active: CaseRecord[] = [];
     try {
@@ -1570,7 +1704,9 @@ export default function casefileExtension(pi: ExtensionAPI) {
       // No database yet — still inject workflow.
     }
 
-    const injection = buildAgentInjection(active);
+    const injection = buildAgentInjection(active, includeWorkflow);
+    if (!injection) return; // workflow already injected, no active cases
+    workflowInjected = true;
 
     // Inject workflow FIRST (before skills) so the attacker mindset is
     // prominent, not buried at the end of a long system prompt.

package/src/ledger.ts

@@ -12,7 +12,7 @@
 
 import { createHash, randomUUID } from "node:crypto";
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { DatabaseSync } from "./sqlite-compat/index.ts";
 
 // ── Types ────────────────────────────────────────────────────────────
@@ -226,8 +226,14 @@ function stableShortId(input: string): string {
 }
 
 function detectWorkspaceRoot(): string {
-  const envs = ["CASEFILE_WORKSPACE_ROOT", "PI_WORKSPACE_ROOT", "GITHUB_WORKSPACE", "PWD"];
-  for (const e of envs) if (process.env[e]) return resolve(process.env[e]!);
+  // PWD is deliberately excluded: it is shell-set, can be stale or forged in
+  // spawned processes, and disagree with the real cwd. Explicit overrides only,
+  // then walk up from the actual cwd.
+  const envs = ["CASEFILE_WORKSPACE_ROOT", "PI_WORKSPACE_ROOT", "GITHUB_WORKSPACE"];
+  for (const e of envs) {
+    const v = process.env[e]?.trim();
+    if (v) return resolve(v);
+  }
 
   let curr = resolve(process.cwd());
   for (let i = 0; i < 20; i++) {
@@ -241,7 +247,10 @@ function detectWorkspaceRoot(): string {
 
 export function getCasefilePath(): string {
   if (ledgerPathOverride) return ledgerPathOverride;
-  if (process.env.PI_CASEFILE_PATH) return resolve(process.env.PI_CASEFILE_PATH.trim());
+  // Trim BEFORE the truthiness check: a whitespace-only value must not
+  // "pass" and resolve to the process cwd ("" resolves to cwd).
+  const envPath = process.env.PI_CASEFILE_PATH?.trim();
+  if (envPath) return resolve(envPath);
   return join(detectWorkspaceRoot(), ".pi", "casefile.db");
 }
 
@@ -622,19 +631,17 @@ function findDuplicateCaseInDb(
   const endpoint = normalizeMatchText(candidate.endpoint);
   const bugClass = normalizeMatchText(candidate.bugClass);
 
-  // Pre-filter by normalized title in SQL so we don't load the whole ledger into
-  // JS just to find a duplicate. normalizeMatchText lowercases + collapses
-  // whitespace, so we match against lower(title) with the same normalization.
-  // The full title/target/endpoint/bugClass match still runs in JS below to catch
-  // whitespace/case differences the SQL LIKE can't express exactly.
-  const sqlTitle = `%${title}%`;
+  // No SQL pre-filter: candidate rows are compared in JS against
+  // normalizeMatchText (lowercase + whitespace-collapse). SQLite's lower() is
+  // ASCII-only and LIKE can't collapse whitespace, so any SQL pre-filter would
+  // silently drop rows the JS comparator would call duplicates (e.g. stored
+  // "SQL  Injection" vs candidate "SQL Injection", or non-ASCII case variants).
+  // Case ledgers are small (hundreds of rows); a full non-killed scan is cheap.
   const rows = excludeId
     ? (db
-        .prepare("SELECT * FROM cases WHERE status != 'killed' AND id != ? AND lower(title) LIKE ?")
-        .all(excludeId, sqlTitle) as any[])
-    : (db
-        .prepare("SELECT * FROM cases WHERE status != 'killed' AND lower(title) LIKE ?")
-        .all(sqlTitle) as any[]);
+        .prepare("SELECT * FROM cases WHERE status != 'killed' AND id != ?")
+        .all(excludeId) as any[])
+    : (db.prepare("SELECT * FROM cases WHERE status != 'killed'").all() as any[]);
 
   for (const row of rows) {
     if (
@@ -922,7 +929,7 @@ export function promoteFindingResult(
   }
 
   const newEvidence =
-    (current.evidence ? current.evidence + "\n\n" : "") +
+    (current.evidence ? `${current.evidence}\n\n` : "") +
     `### PoC Execution Capture (${verification.ranAt})\n` +
     `- **Exit Code:** ${verification.exitCode}\n` +
     `- **Sandbox:** ${verification.sandbox ? "yes" : "no"}\n` +
@@ -1171,7 +1178,7 @@ function mapRowsWithLinks(db: DatabaseSync, rows: any[]): CaseRecord[] {
   const linkMap = new Map<string, { id: string; kind: string }[]>();
   for (const l of links) {
     if (!linkMap.has(l.source_id)) linkMap.set(l.source_id, []);
-    linkMap.get(l.source_id)!.push({ id: l.target_id, kind: l.kind });
+    linkMap.get(l.source_id)?.push({ id: l.target_id, kind: l.kind });
   }
   return rows.map((row) => mapRow(row, linkMap.get(row.id) ?? []));
 }
@@ -1323,14 +1330,14 @@ export function writeCaseReport(id: string): { path: string; record: CaseRecord
     current.pocVerified
       ? mdSection(
           "PoC Verification Log",
-          `### PoC Run Verification\n- **Timestamp:** ${current.pocVerified.ranAt}\n- **Path:** \`${current.pocVerified.path}\`\n- **Sandbox:** ${current.pocVerified.sandbox ? "yes" : "no"}\n- **Exit Code:** ${current.pocVerified.exitCode}\n\n#### Output\n\`\`\`\n${current.pocVerified.output ?? ""}\n\`\`\``,
+          `### PoC Run Verification\n- **Timestamp:** ${current.pocVerified.ranAt}\n- **Script:** \`${basename(current.pocVerified.path)}\`\n- **Sandbox:** ${current.pocVerified.sandbox ? "yes" : "no"}\n- **Exit Code:** ${current.pocVerified.exitCode}\n\n#### Output\n\`\`\`\n${current.pocVerified.output ?? ""}\n\`\`\``,
         )
       : undefined,
     mdSection("Disconfirmation Attempt", current.disconfirmation),
     current.disconfirmationVerified
       ? mdSection(
           "Disconfirmation Verification Log",
-          `### Disconfirmation Run Verification\n- **Timestamp:** ${current.disconfirmationVerified.ranAt}\n- **Path:** \`${current.disconfirmationVerified.path}\`\n- **Sandbox:** ${current.disconfirmationVerified.sandbox ? "yes" : "no"}\n- **Exit Code:** ${current.disconfirmationVerified.exitCode} (non-zero = finding survived the attempt to disprove)\n\n#### Output\n\`\`\`\n${current.disconfirmationVerified.output ?? ""}\n\`\`\``,
+          `### Disconfirmation Run Verification\n- **Timestamp:** ${current.disconfirmationVerified.ranAt}\n- **Script:** \`${basename(current.disconfirmationVerified.path)}\`\n- **Sandbox:** ${current.disconfirmationVerified.sandbox ? "yes" : "no"}\n- **Exit Code:** ${current.disconfirmationVerified.exitCode} (non-zero = finding survived the attempt to disprove)\n\n#### Output\n\`\`\`\n${current.disconfirmationVerified.output ?? ""}\n\`\`\``,
         )
       : undefined,
     mdSection("Impact", current.impact),

package/src/pipeline-submit.ts

@@ -0,0 +1,509 @@
+/**
+ * PipelineSubmit — the stage-output gate.
+ *
+ * The coordinator (model) dispatches stage subagents and submits their output
+ * here. This module is where the pipeline stops trusting prose: it validates
+ * stage output against the field specs mirrored from schemas/*.json, applies
+ * the deterministic pre-filter (test paths, hallucinated files, trivial dedup),
+ * and counts repair attempts. A stage cannot advance on an invalid output —
+ * the answer is REPAIR (with field-level errors) or REJECTED, in code.
+ *
+ * KEEP IN SYNC with schemas/*.json at the repo root. The JSON schemas are the
+ * canonical data contract for documentation; the SPECS table here is the
+ * executable gate (a focused validator for exactly these six shapes — no
+ * general JSON Schema engine).
+ *
+ * Persistence: .scratchpad/{run_id}/pipeline-submit.json
+ *   { repairs: { "<stage>:<key>": n }, accepted_findings: FindingRef[] }
+ */
+
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import {
+  getRunDir,
+  getScratchpadRoot,
+  type ScratchpadPhase,
+  scratchpad_write,
+} from "./scratchpad.ts";
+
+// ── Types ────────────────────────────────────────────────────────────
+
+export const SUBMIT_STAGES = ["hunt", "trace", "skeptic", "validate", "chain", "report"] as const;
+export type SubmitStage = (typeof SUBMIT_STAGES)[number];
+
+export type SubmitVerdict = "accepted" | "repair" | "rejected";
+
+export type SubmitResult = {
+  verdict: SubmitVerdict;
+  stage: SubmitStage;
+  /** Field-level validation errors (repair) or rejection reason (rejected). */
+  errors: string[];
+  /** Repair attempt number (1-based) when verdict is repair. */
+  repair_attempt?: number;
+  /** Stable key identifying this finding's repair bucket. */
+  key?: string;
+  /** Set when hunt-stage dedup matched an accepted finding. */
+  duplicate_of?: string;
+  /** Scratchpad path the accepted output was written to. */
+  artifact?: string;
+};
+
+type StageSpec = {
+  /** Fields that must be present and non-empty. */
+  required: {
+    name: string;
+    type: "string" | "integer" | "array" | "object";
+    enum?: readonly string[];
+    minItems?: number;
+  }[];
+  /** Exactly one of these locator field-sets must be fully present. */
+  locatorXor?: [string[], string[]];
+  /** Conditional requirements: when field equals value, these must be non-empty. */
+  conditional?: { when: { field: string; equals: string }; require: string[] }[];
+};
+
+// ── Stage specs (mirror of schemas/*.json semantics) ─────────────────
+
+const VULN_CLASSES = [
+  "injection",
+  "xss",
+  "idor",
+  "bola",
+  "path-traversal",
+  "ssrf",
+  "command-injection",
+  "deserialization",
+  "auth-bypass",
+  "privilege-escalation",
+  "business-logic",
+  "race-condition",
+  "xxe",
+  "ssti",
+  "open-redirect",
+  "information-disclosure",
+  "crypto-weakness",
+  "other",
+] as const;
+
+const KILL_REASONS = [
+  "unreachable",
+  "framework_protection",
+  "input_validation_blocks",
+  "requires_privilege_attacker_lacks",
+  "poc_failed_3x",
+  "no_real_impact",
+  "intended_behavior",
+  "duplicate",
+] as const;
+
+const SPECS: Record<SubmitStage, StageSpec> = {
+  // schemas/stage-finding.json
+  hunt: {
+    required: [
+      { name: "vuln_class", type: "string", enum: VULN_CLASSES },
+      { name: "sink", type: "string" },
+      { name: "entry_point", type: "string" },
+      { name: "confidence", type: "string", enum: ["low", "medium", "high"] },
+      { name: "evidence", type: "string" },
+    ],
+    // Source targets: file + line. Live targets: endpoint.
+    locatorXor: [["file", "line"], ["endpoint"]],
+  },
+  // schemas/stage-trace.json
+  trace: {
+    required: [
+      { name: "trace_result", type: "string", enum: ["REACHABLE", "UNREACHABLE"] },
+      { name: "entry_point", type: "string" },
+      { name: "call_chain", type: "array", minItems: 1 },
+      { name: "defenses_checked", type: "array" },
+      { name: "attacker_model", type: "string" },
+    ],
+    conditional: [
+      { when: { field: "trace_result", equals: "REACHABLE" }, require: ["impact_if_reachable"] },
+      { when: { field: "trace_result", equals: "UNREACHABLE" }, require: ["unreachable_reason"] },
+    ],
+  },
+  // schemas/stage-skeptic.json
+  skeptic: {
+    required: [
+      { name: "finding_id", type: "string" },
+      { name: "verdict", type: "string", enum: ["CONFIRMED", "DISPROVEN"] },
+      { name: "reasoning", type: "string" },
+      { name: "evidence_reviewed", type: "array", minItems: 1 },
+    ],
+    conditional: [
+      { when: { field: "verdict", equals: "DISPROVEN" }, require: ["disproval_reason"] },
+    ],
+  },
+  // schemas/stage-validation.json
+  validate: {
+    required: [
+      { name: "finding_id", type: "string" },
+      { name: "status", type: "string", enum: ["confirmed", "killed", "reported"] },
+      { name: "technique_used", type: "string" },
+      { name: "detection_method", type: "string" },
+    ],
+    conditional: [
+      {
+        when: { field: "status", equals: "confirmed" },
+        require: ["poc_path", "run_log", "evidence_extracted"],
+      },
+      { when: { field: "status", equals: "killed" }, require: ["kill_reason"] },
+    ],
+  },
+  // schemas/stage-chain.json
+  chain: {
+    required: [
+      { name: "chains", type: "array" },
+      { name: "summary", type: "string" },
+    ],
+  },
+  // schemas/stage-report.json
+  report: {
+    required: [
+      { name: "target", type: "string" },
+      { name: "pipeline_status", type: "string", enum: ["complete", "partial", "aborted"] },
+      { name: "findings", type: "array" },
+      { name: "coverage", type: "object" }, // patternProperties object, not array
+      { name: "summary", type: "string" },
+    ],
+  },
+};
+
+const MAX_REPAIR_ATTEMPTS = 2;
+
+// Segment-based test-path detection: matches "test", "__tests__", "specs",
+// "e2e", "test-utils", "fixtures", ... anchored per path segment so
+// "latest"/"contest"/"attest" do NOT match. A regex-only version missed
+// leading underscores ("__tests__").
+const TEST_SEGMENT_RE =
+  /^[._-]*(tests?|specs?|e2e|fixtures?|mocks?|stubs?|examples?|samples?|test[-_]?data|test[-_]?utils)[._-]*$/i;
+const TEST_FILE_RE =
+  /([._-](test|spec|mock|fixture|stub|example|sample)\.[a-z0-9]+$|^test[-_]utils\.[a-z0-9]+$)/i;
+
+/** Chain items: each must have title, severity, steps (≥2), narrative. */
+const CHAIN_SEVERITIES = ["low", "medium", "high", "critical"] as const;
+
+// ── Pre-filter constants (hunt stage only) ───────────────────────────
+
+/**
+ * Test/mock/example paths carry no real findings (mirrors VVAH S5). Exception
+ * from VVAH deliberately not copied: hardcoded-creds-in-test-files — the
+ * auditor can submit those under vuln_class "other"+bugClass documentation;
+ * the gate errs on filtering noise.
+ */
+
+/** Trivial dedup: same file + vuln_class + line within this tolerance. */
+const DEDUP_LINE_TOLERANCE = 10;
+
+// ── Persistence ─────────────────────────────────────────────────────
+
+type FindingRef = {
+  key: string;
+  file: string;
+  line?: number;
+  vuln_class: string;
+};
+
+type SubmitState = {
+  repairs: Record<string, number>;
+  accepted_findings: FindingRef[];
+};
+
+function statePath(runId: string): string {
+  return join(getRunDir(runId), "pipeline-submit.json");
+}
+
+function readState(runId: string): SubmitState {
+  const p = statePath(runId);
+  if (!existsSync(p)) return { repairs: {}, accepted_findings: [] };
+  try {
+    const raw = JSON.parse(readFileSync(p, "utf8")) as Partial<SubmitState>;
+    return {
+      repairs: raw.repairs ?? {},
+      accepted_findings: raw.accepted_findings ?? [],
+    };
+  } catch {
+    return { repairs: {}, accepted_findings: [] };
+  }
+}
+
+function writeState(runId: string, state: SubmitState): void {
+  writeFileSync(statePath(runId), JSON.stringify(state, null, 2), "utf8");
+}
+
+/** Project root containing the scratchpad (file-existence checks resolve here). */
+function projectRoot(): string {
+  return dirname(getScratchpadRoot());
+}
+
+// ── Parsing ──────────────────────────────────────────────────────────
+
+function parseOutput(output: unknown): { obj?: Record<string, unknown>; error?: string } {
+  if (typeof output === "object" && output !== null && !Array.isArray(output)) {
+    return { obj: output as Record<string, unknown> };
+  }
+  if (typeof output !== "string") {
+    return { error: "output must be a JSON object or a JSON string" };
+  }
+  let text = output.trim();
+  // Tolerate markdown code fences around the payload.
+  text = text.replace(/^```(?:json)?\s*\n?/i, "").replace(/\n?```\s*$/i, "");
+  try {
+    const parsed = JSON.parse(text);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return { error: "output must parse to a JSON object" };
+    }
+    return { obj: parsed as Record<string, unknown> };
+  } catch (e) {
+    return { error: `output is not valid JSON: ${(e as Error).message.slice(0, 120)}` };
+  }
+}
+
+/** Stable repair-bucket key for a submission. */
+function submissionKey(stage: SubmitStage, obj: Record<string, unknown>): string {
+  const id =
+    (typeof obj.finding_id === "string" && obj.finding_id) ||
+    (typeof obj.title === "string" && obj.title) ||
+    (typeof obj.id === "string" && obj.id);
+  const tail = id ?? createHash("sha1").update(JSON.stringify(obj)).digest("hex").slice(0, 8);
+  return `${stage}:${tail}`;
+}
+
+// ── Validation ──────────────────────────────────────────────────────
+
+function isNonEmptyString(v: unknown): v is string {
+  return typeof v === "string" && v.trim().length > 0;
+}
+
+function validateStage(stage: SubmitStage, obj: Record<string, unknown>): string[] {
+  const spec = SPECS[stage];
+  const errors: string[] = [];
+
+  for (const field of spec.required) {
+    const v = obj[field.name];
+    if (field.type === "string") {
+      if (!isNonEmptyString(v)) {
+        errors.push(`${field.name}: missing or empty string`);
+        continue;
+      }
+    } else if (field.type === "object") {
+      if (typeof v !== "object" || v === null || Array.isArray(v)) {
+        errors.push(`${field.name}: missing or not an object`);
+        continue;
+      }
+    } else if (field.type === "integer") {
+      if (typeof v !== "number" || !Number.isInteger(v)) {
+        errors.push(`${field.name}: missing or not an integer`);
+        continue;
+      }
+    } else {
+      if (!Array.isArray(v)) {
+        errors.push(`${field.name}: missing or not an array`);
+        continue;
+      }
+      if (field.minItems !== undefined && v.length < field.minItems) {
+        errors.push(`${field.name}: needs at least ${field.minItems} item(s), got ${v.length}`);
+        continue;
+      }
+    }
+    if (field.enum && !field.enum.includes(v as never)) {
+      errors.push(`${field.name}: "${String(v)}" not in { ${field.enum.join(" | ")} }`);
+    }
+  }
+
+  if (spec.locatorXor) {
+    const [a, b] = spec.locatorXor;
+    const hasSet = (set: string[]) =>
+      set.every((f) => (f === "line" ? Number.isInteger(obj[f]) : isNonEmptyString(obj[f])));
+    const hasA = hasSet(a);
+    const hasB = hasSet(b);
+    if (hasA === hasB) {
+      errors.push(
+        `locator: provide exactly one of { ${a.join("+")} } (source) or { ${b.join("+")} } (live)`,
+      );
+    }
+    if (hasA && typeof obj.line === "number" && obj.line < 1) {
+      errors.push("line: must be >= 1");
+    }
+  }
+
+  for (const cond of spec.conditional ?? []) {
+    if (obj[cond.when.field] === cond.when.equals) {
+      for (const name of cond.require) {
+        if (!isNonEmptyString(obj[name])) {
+          errors.push(`${name}: required when ${cond.when.field} = ${cond.when.equals}`);
+        }
+      }
+    }
+  }
+
+  // Chain items have their own inner contract (≥2 steps, severity enum).
+  if (stage === "chain" && Array.isArray(obj.chains)) {
+    obj.chains.forEach((c, i) => {
+      const chain = c as Record<string, unknown>;
+      if (!isNonEmptyString(chain.title)) errors.push(`chains[${i}].title: missing or empty`);
+      if (
+        !isNonEmptyString(chain.severity) ||
+        !(CHAIN_SEVERITIES as readonly string[]).includes(chain.severity)
+      ) {
+        errors.push(`chains[${i}].severity: must be one of { ${CHAIN_SEVERITIES.join(" | ")} }`);
+      }
+      if (!Array.isArray(chain.steps) || chain.steps.length < 2) {
+        errors.push(`chains[${i}].steps: needs at least 2 case IDs`);
+      }
+      if (!isNonEmptyString(chain.narrative))
+        errors.push(`chains[${i}].narrative: missing or empty`);
+    });
+  }
+
+  return errors;
+}
+
+// ── Pre-filter + dedup (hunt only) ──────────────────────────────────
+
+function prefilterHunt(obj: Record<string, unknown>): string | null {
+  const file = typeof obj.file === "string" ? obj.file : undefined;
+  if (!file) return null; // live target: endpoint locator, nothing to filter
+  const normalized = file.replace(/^\.?\//, "");
+  const segments = normalized.split("/");
+  if (segments.some((s) => TEST_SEGMENT_RE.test(s)) || TEST_FILE_RE.test(normalized)) {
+    return (
+      `test-path filter: "${file}" matches test/fixture/mock paths — findings in ` +
+      `test code are noise. If this is a deliberately-shipped test credential, ` +
+      `re-submit documenting why it ships to production.`
+    );
+  }
+  const root = projectRoot();
+  const abs = isAbsolute(normalized) ? resolve(normalized) : resolve(root, normalized);
+  // Containment: resolved path must stay inside the project, otherwise a
+  // "finding" can point at ../ or absolute files outside the target repo.
+  const rel = relative(root, abs);
+  if (rel.startsWith("..") || isAbsolute(rel)) {
+    return (
+      `containment filter: "${file}" resolves outside the project root (${root}). ` +
+      `Findings must reference files inside the target repository.`
+    );
+  }
+  if (!existsSync(abs)) {
+    return (
+      `file-existence filter: "${file}" does not exist under the project root ` +
+      `(${root}). Hallucinated paths are rejected outright.`
+    );
+  }
+  return null;
+}
+
+function dedupHunt(state: SubmitState, obj: Record<string, unknown>): { duplicateOf?: string } {
+  const file = typeof obj.file === "string" ? obj.file.replace(/^\.?\//, "") : undefined;
+  const vulnClass = typeof obj.vuln_class === "string" ? obj.vuln_class : undefined;
+  const line = typeof obj.line === "number" ? obj.line : undefined;
+  if (!file || !vulnClass) return {};
+  for (const accepted of state.accepted_findings) {
+    if (accepted.vuln_class !== vulnClass) continue;
+    if (accepted.file !== file) continue;
+    if (
+      line !== undefined &&
+      accepted.line !== undefined &&
+      Math.abs(line - accepted.line) > DEDUP_LINE_TOLERANCE
+    ) {
+      continue;
+    }
+    return { duplicateOf: accepted.key };
+  }
+  return {};
+}
+
+// ── Public API ───────────────────────────────────────────────────────
+
+const STAGE_TO_PHASE: Record<SubmitStage, ScratchpadPhase> = {
+  hunt: "hunt",
+  trace: "trace",
+  skeptic: "skeptic",
+  validate: "validate",
+  chain: "chain",
+  report: "report",
+};
+
+export function pipeline_submit(runId: string, stage: SubmitStage, output: unknown): SubmitResult {
+  const parsed = parseOutput(output);
+  if (parsed.error || !parsed.obj) {
+    const state = readState(runId);
+    const key = `${stage}:unparseable`;
+    state.repairs[key] = (state.repairs[key] ?? 0) + 1;
+    const attempt = state.repairs[key];
+    // Persist before BOTH returns — otherwise unparseable output bypasses the
+    // repair budget forever (counter never hits disk on the rejected path).
+    writeState(runId, state);
+    if (attempt > MAX_REPAIR_ATTEMPTS) {
+      return { verdict: "rejected", stage, errors: [parsed.error ?? "unparseable"], key };
+    }
+    return {
+      verdict: "repair",
+      stage,
+      errors: [parsed.error ?? "unparseable"],
+      repair_attempt: attempt,
+      key,
+    };
+  }
+
+  const obj = parsed.obj;
+  const key = submissionKey(stage, obj);
+
+  const errors = validateStage(stage, obj);
+  if (errors.length > 0) {
+    const state = readState(runId);
+    state.repairs[key] = (state.repairs[key] ?? 0) + 1;
+    const attempt = state.repairs[key];
+    if (attempt > MAX_REPAIR_ATTEMPTS) {
+      writeState(runId, state);
+      return {
+        verdict: "rejected",
+        stage,
+        errors: [...errors, `repair budget exhausted (${MAX_REPAIR_ATTEMPTS} attempts)`],
+        key,
+      };
+    }
+    writeState(runId, state);
+    return { verdict: "repair", stage, errors, repair_attempt: attempt, key };
+  }
+
+  // Hunt stage: deterministic noise gates before acceptance.
+  if (stage === "hunt") {
+    const filtered = prefilterHunt(obj);
+    if (filtered) {
+      return { verdict: "rejected", stage, errors: [filtered], key };
+    }
+    const state = readState(runId);
+    const { duplicateOf } = dedupHunt(state, obj);
+    if (duplicateOf) {
+      return {
+        verdict: "rejected",
+        stage,
+        errors: [
+          `trivial dedup: same file + vuln_class within ${DEDUP_LINE_TOLERANCE} lines of accepted finding ${duplicateOf}`,
+        ],
+        key,
+        duplicate_of: duplicateOf,
+      };
+    }
+    if (typeof obj.file === "string" && typeof obj.vuln_class === "string") {
+      state.accepted_findings.push({
+        key,
+        file: obj.file.replace(/^\.?\//, ""),
+        line: typeof obj.line === "number" ? obj.line : undefined,
+        vuln_class: obj.vuln_class,
+      });
+      writeState(runId, state);
+    }
+  }
+
+  const artifact = scratchpad_write(
+    runId,
+    STAGE_TO_PHASE[stage],
+    `${key.replace(/[^a-zA-Z0-9._:-]/g, "_")}.json`,
+    JSON.stringify(obj, null, 2),
+  );
+  return { verdict: "accepted", stage, errors: [], key, artifact };
+}

package/src/scratchpad.ts

@@ -47,8 +47,6 @@ export interface ScratchpadCheckpoint {
   phase_ids: Record<ScratchpadPhase, string[]>;
   /** Free-form summary per phase, set by checkpoint(). */
   phase_summaries: Record<ScratchpadPhase, string>;
-  /** Whether the run is fully complete. */
-  done: boolean;
 }
 
 export interface ScratchpadResume {
@@ -98,7 +96,9 @@ let scratchpadRootOverride: string | undefined;
 function detectWorkspaceRoot(): string {
   if (scratchpadRootOverride) return scratchpadRootOverride;
 
-  const envs = ["XPI_SCRATCHPAD_ROOT", "PI_WORKSPACE_ROOT", "GITHUB_WORKSPACE", "PWD"];
+  // PWD is deliberately excluded (shell-set, can be stale/forged); explicit
+  // overrides only, then walk up from the real cwd.
+  const envs = ["XPI_SCRATCHPAD_ROOT", "PI_WORKSPACE_ROOT", "GITHUB_WORKSPACE"];
   for (const e of envs) {
     const v = process.env[e];
     if (v) return resolve(v);
@@ -125,9 +125,24 @@ export function getScratchpadRoot(projectRoot?: string): string {
   return join(root, SCRATCHPAD_DIR);
 }
 
+/**
+ * Sanitize a run_id into a single safe directory name. Unlike artifact names,
+ * run_ids arrive from the agent and were never sanitized — `..`/`/` would let
+ * join() escape .scratchpad, turning ScratchpadClear("..") into a recursive
+ * delete of the project root. Same allowlist as artifact names, plus rejection
+ * of dot-only results (.", "..", or a sanitized empty string).
+ */
+function sanitizeRunId(runId: string): string {
+  const safe = runId.replace(/[^a-zA-Z0-9._-]/g, "_");
+  if (!safe || /^\.*$/.test(safe)) {
+    throw new Error(`Invalid run_id: "${runId}" — nothing left after sanitization`);
+  }
+  return safe;
+}
+
 /** The directory for a specific run. */
 export function getRunDir(runId: string, projectRoot?: string): string {
-  return join(getScratchpadRoot(projectRoot), runId);
+  return join(getScratchpadRoot(projectRoot), sanitizeRunId(runId));
 }
 
 /** The state.json path for a run. */
@@ -146,7 +161,6 @@ function emptyCheckpoint(runId: string, projectRoot: string): ScratchpadCheckpoi
     completed_phases: [],
     phase_ids: {} as Record<ScratchpadPhase, string[]>,
     phase_summaries: {} as Record<ScratchpadPhase, string>,
-    done: false,
   };
 }
 
@@ -323,37 +337,3 @@ export function scratchpad_clear(runId: string, projectRoot?: string): void {
   const runDir = getRunDir(runId, root);
   if (existsSync(runDir)) rmSync(runDir, { recursive: true, force: true });
 }
-
-/**
- * Clear the entire scratchpad directory (all runs). Used by `--fresh` with no
- * run ID. Use with care.
- */
-export function scratchpad_clear_all(projectRoot?: string): void {
-  const root = projectRoot ?? detectWorkspaceRoot();
-  const dir = getScratchpadRoot(root);
-  if (existsSync(dir)) rmSync(dir, { recursive: true, force: true });
-}
-
-/**
- * List all run IDs in the scratchpad (for resume selection).
- */
-export function scratchpad_list_runs(projectRoot?: string): string[] {
-  const root = projectRoot ?? detectWorkspaceRoot();
-  const dir = getScratchpadRoot(root);
-  if (!existsSync(dir)) return [];
-  return readdirSync(dir, { withFileTypes: true })
-    .filter((e) => e.isDirectory())
-    .map((e) => e.name)
-    .sort();
-}
-
-/**
- * Mark the run as fully done. Prevents resume from re-entering.
- */
-export function scratchpad_finish(runId: string, projectRoot?: string): ScratchpadCheckpoint {
-  const root = projectRoot ?? detectWorkspaceRoot();
-  const cp = readCheckpointRaw(runId, root) ?? scratchpad_init(runId, root);
-  cp.done = true;
-  writeCheckpointRaw(cp, root);
-  return cp;
-}

package/src/workflow.ts

@@ -1,7 +1,7 @@
 /**
  * Cyber workflow injected into agent context when XP mode is ON.
  *
- * Skills (pipeline, web-pentest) already cover tool usage and methodology.
+ * Skills (cyberwf, web-pentest) already cover tool usage and methodology.
  * This file adds the unique attacker discipline: state machine with
  * preconditions, attacker model, impact validation, adversarial review,
  * kill checklist, and report-readiness criteria.
@@ -17,6 +17,16 @@ Think like a real external attacker, not a code reviewer. Technical bugs are che
 
 Every lead starts HYPOTHESIS. Nothing reaches CONFIRMED without a proven attacker path and demonstrated impact against a real production target or faithful replica.
 
+## Tool Reference
+
+**Casefile (state tracking):** CaseAdd, CaseUpdate, CaseGet, CaseList, CaseSearch, CaseLink, CaseUnlink, CaseReport, PromoteFinding, PipelineSubmit
+
+**Scratchpad (pipeline artifacts):** ScratchpadInit, ScratchpadResume, ScratchpadCheckpoint, ScratchpadWrite, ScratchpadRead, ScratchpadPhaseDone, ScratchpadClear
+
+**Web lookup (research):** web_search, web_fetch, exploit_search, context7, deepwiki, http_request
+
+**Subagent dispatch:** \`subagent({agent: "auditor"|"tracer"|"skeptic"|"exploit"|"chain", task: "..."})\` — use this to dispatch specialist agents. Do NOT do the specialist work yourself.
+
 ## Case Lifecycle (State Machine)
 
 \`\`\`
@@ -47,7 +57,7 @@ RECON -> HYPOTHESIS --+
 | Advance To | Required Case Fields | Must Exist on Disk |
 |-----------|---------------------|--------------------|
 | HYPOTHESIS -> INVESTIGATING | evidence (observations or initial findings), confidence | Notes on what was observed |
-| INVESTIGATING -> **CONFIRMED** | evidence, poc (steps/script), **impact (see below for content requirements)**, severity, **target (host/repo/scope this affects)**, **disconfirmation (your documented attempt to disprove the finding)** | PoC script + run.log exit 0. Optionally, disconfirmation script run.log exit non-0 (finding survived the attempt to disprove). |
+| INVESTIGATING -> **CONFIRMED** | evidence, poc (steps/script), **impact (see below for content requirements)**, severity, **target (host/repo/scope this affects)**, **disconfirmation (your documented attempt to disprove the finding)** | PoC script + exit 0 + **verification_marker present in output** (proves the exploit actually worked, not just that the script ran). Optionally, disconfirmation script run.log exit non-0 (finding survived the attempt to disprove). |
 | Any -> KILLED | assumptions (why it died) | --- |
 | CONFIRMED -> REPORTED | Only after CaseReport(id) succeeds | Report file |
 
@@ -109,22 +119,20 @@ Before promoting to CONFIRMED, the following must be fully answered and document
 
 If you cannot name a concrete attacker who gains something they should not have -> do **not** confirm. Stay INVESTIGATING or KILL with documented reason.
 
-### 1. Disconfirmation Attempt (mandatory field before CONFIRMED)
+### 1. Disconfirmation (mandatory before CONFIRMED)
 
-Before promoting, you must actively attempt to disprove your own finding.
-This is not a formality --- the attempt is documented in the \`disconfirmation\`
-field and verified by the optional \`disconfirmation_path\` in PromoteFinding.
+Before promoting to CONFIRMED, the finding must survive an attempt to disprove it. There are two tiers, gated on the auditor's \`confidence\` (severity doesn't exist yet — the exploit agent assigns it only after the PoC runs):
+
+**\`confidence: high\` → skeptic subagent (MANDATORY):** You MUST dispatch a skeptic subagent via \`subagent({agent: "skeptic", task: "..."})\` BEFORE the exploit agent runs. The skeptic independently re-reads the source (or re-probes live), verifies the finding is in scope per the program's scope instruction, and tries to disprove it. The skeptic's \`disconfirmation_attempt\` is written into the case's \`disconfirmation\` field — it satisfies this gate and is stronger than self-disconfirmation because a separate agent produced it. If the skeptic says DISPROVEN, the finding is killed directly — no tie-breaker. Do NOT skip this step. Do NOT self-disconfirm high-confidence findings.
+
+**Below confidence high → self-disconfirmation:** You must actively attempt to disprove your own finding. Document the attempt in the \`disconfirmation\` field. This is not a formality.
 
 **What a disconfirmation attempt looks like:**
 
-- Reproduce the finding under different conditions (different auth, different
-  config, different network position). If it fails, you disproved the scope.
-- Check if the behavior is intentional by testing against documentation or
-  by trying to get the same result on a known-baseline endpoint.
-- Attempt to trigger protections (WAF, CSP, CSRF, rate limits) that would
-  block the path in production.
-- Try to prove the root cause is wrong: can the same behavior be triggered
-  without the attacker-controlled input you identified?
+- Reproduce the finding under different conditions (different auth, different config, different network position). If it fails, you disproved the scope.
+- Check if the behavior is intentional by testing against documentation or by trying to get the same result on a known-baseline endpoint.
+- Attempt to trigger protections (WAF, CSP, CSRF, rate limits) that would block the path in production.
+- Try to prove the root cause is wrong: can the same behavior be triggered without the attacker-controlled input you identified?
 
 **Document the attempt in \`disconfirmation\` field.** Must include:
 1. What you tried to do to disprove the finding
@@ -133,21 +141,12 @@ field and verified by the optional \`disconfirmation_path\` in PromoteFinding.
 4. Why you believe the disconfirmation attempt was valid
 
 **Strong disconfirmation that passes the gate:**
-"Attempted to read /api/users/123 as user B after confirming user A owns
-record 123. The endpoint returned 403 for user B, confirming the IDOR
-protection works as expected. However, when we modified the request to
-include the X-Override-User header seen in admin traffic, the endpoint
-returned user A's data. The protection is bypassed via the admin header."
+"Attempted to read /api/users/123 as user B after confirming user A owns record 123. The endpoint returned 403 for user B, confirming the IDOR protection works as expected. However, when we modified the request to include the X-Override-User header seen in admin traffic, the endpoint returned user A's data. The protection is bypassed via the admin header."
 
 **Weak disconfirmation:**
 "Tried to disprove. Could not."
 
-If the disconfirmation script (disconfirmation_path) exits 0, the finding
-is considered disproven and promotion is blocked. If you cannot write a
-meaningful disconfirmation script, you may not understand the finding well
-enough to promote it.
-
-**Adversarial disconfirmation (skeptic subagent):** For findings at severity >= high, a dedicated skeptic subagent independently re-reads the source and tries to disprove the finding BEFORE the exploit agent runs. The skeptic's \`disconfirmation_attempt\` is written into this \`disconfirmation\` field by the harness — it satisfies this gate and is stronger than self-disconfirmation because a separate agent produced it. If the skeptic says DISPROVEN, the finding is killed directly. Self-disconfirmation still applies for findings below high severity.
+If the disconfirmation script (\`disconfirmation_path\` in PromoteFinding) exits 0, the finding is considered disproven and promotion is blocked. If you cannot write a meaningful disconfirmation script, you may not understand the finding well enough to promote it.
 
 ### 2. Production Path Verification (must be in impact field)
 
@@ -166,7 +165,7 @@ The **impact** field for CONFIRMED must explicitly answer:
 
 You must name the **specific target host/repo** in the target field. If the finding only works on a dev instance with non-default config, document that honestly and consider whether it's KILL-worthy.
 
-### 2. KILL at Validate stage
+### 3. KILL at Validate stage
 
 Documented intended behavior
 - Self-XSS / self-DoS only (attacker harms only their own session)
@@ -177,11 +176,11 @@ Documented intended behavior
 - PoC proves a code path exists but not that any victim asset is affected
 - Protections in production block the path and are not bypassed
 
-### 3. Evidence-First Doctrine
+### 4. Evidence-First Doctrine
 
 Every claim must be traceable to observed/reproduced behavior, source code, or documented platform behavior. If evidence is insufficient: state uncertainty and propose the next experiment. Never assume success where verification is incomplete.
 
-### 4. Impact Gate
+### 5. Impact Gate
 
 Prove at least **one** real attacker-facing violation against a production-viable target:
 
@@ -196,7 +195,16 @@ Impact text must answer: *who is hurt, what is lost, how the attacker reaches it
 
 If impact is theoretical, needs a second unproven bug, or is not yet reachable from the attacker's position -> stay INVESTIGATING (chain it) or KILL.
 
-### 5. Adversarial Self-Review
+**Severity is derived from PROVEN impact, not guessed.** Do not set severity until the PoC has exited 0 and the output demonstrates the impact. Map severity to what the PoC output actually shows:
+- **critical** = RCE, account takeover, or direct fund theft — proven in PoC output
+- **high** = sensitive data read/write, privilege escalation, SSRF to internal services — proven in PoC output
+- **medium** = limited data exposure, XSS on sensitive page, IDOR on non-critical resources — proven in PoC output
+- **low** = info leak, open redirect, self-only impact with a victim path — proven but minimal harm
+- **info** = best-practice gap, no demonstrated impact
+
+"Could lead to" / "may allow" / "theoretically" = NOT proven. Drop to the level the PoC output actually demonstrates. Under-claiming is safe; over-claiming gets the finding rejected at triage.
+
+### 6. Adversarial Self-Review
 
 1. Why this might NOT be a vulnerability.
 2. Alternative explanations for the observation.
@@ -204,7 +212,7 @@ If impact is theoretical, needs a second unproven bug, or is not yet reachable f
 4. What blocks a real attacker in production today and whether each is bypassed.
 5. Would a program triage reject this as informative/N/A?
 
-### 6. Root Cause -> Boundary -> Impact
+### 7. Root Cause -> Boundary -> Impact
 
 \`\`\`
 Entry (attacker-controlled) -> Code path -> Trust boundary crossed -> Victim impact