@xaccefy/pi-casefile 0.7.6 → 0.8.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +13 -4
- package/package.json +1 -1
- package/src/index.ts +524 -305
- package/src/ledger.ts +910 -176
- package/src/pipeline-submit.ts +7 -17
- package/src/poc-runner.ts +63 -123
- package/src/scratchpad.ts +38 -39
- package/src/workflow.ts +36 -30
package/README.md
CHANGED
|
@@ -44,21 +44,30 @@ hypothesis → investigating → confirmed → reported
|
|
|
44
44
|
```
|
|
45
45
|
|
|
46
46
|
- **investigating** needs `evidence` + `confidence`
|
|
47
|
-
- **confirmed** only by running the PoC (`PromoteFinding`, exit 0) — you can't just set status to confirmed
|
|
47
|
+
- **confirmed** only by running the PoC (`PromoteFinding`, exit 0 + verification marker in output) — you can't just set status to confirmed. Promotion additionally requires an EvidenceAdd `observation` item (the initial signal) — the ledger rejects a `confirmed` with no evidence chain.
|
|
48
|
+
- **Live findings (`local:true`) also require `control_path`**: the same PoC run against a control lacking the vuln must NOT print the marker. The harness checks the control output itself — an unconditional-marker or mock-target PoC is blocked. The control run is stored as `controlVerified`. A control or disconfirmation script that **crashes** (killed / timeout / spawn error — no completion marker) is blocked too: a crash is not a clean control verdict and not a survived disproof. This applies at the ledger level, not just the tool: a local (sandbox:false) promotion without `controlVerification` is rejected by `promoteFindingResult` itself.
|
|
49
|
+
- **New cases require `disproveIf`** — falsification conditions (what would disprove this hypothesis). A hypothesis that can't say what kills it isn't one yet.
|
|
50
|
+
- **A kill must be justified**: either an EvidenceAdd `refutation` item, or a kill-reason token (intended_behavior, duplicate, framework_protection, out_of_scope, skeptic-disproven, no_attack_path, ...) in assumptions/nextStep. Bare `status: "killed"` is rejected.
|
|
48
51
|
- **reported** needs `CaseContext` first (records the report path; the report writer produces the final file)
|
|
49
52
|
- **killed** / **reported** are final (no more edits)
|
|
50
53
|
|
|
51
|
-
|
|
54
|
+
## Evidence items
|
|
55
|
+
|
|
56
|
+
`EvidenceAdd` records role-typed, artifact-backed evidence (observation / reproduction / impact / refutation / cleanup). Artifacts are stored as basename + SHA-256 — the full path is never persisted. The PoC gate auto-records the `reproduction` item (the PoC file, hashed) at promotion, so a confirmed case always traces back to a real artifact. `cleanup` items track engagement cleanup; record and confirm them before REPORT for sanctioned engagements (advisory — not yet a hard gate).
|
|
52
57
|
|
|
53
58
|
## Tools
|
|
54
59
|
|
|
55
60
|
| Tool | Use |
|
|
56
61
|
|------|-----|
|
|
57
|
-
| `CaseAdd` | Open a case (`title` required; start as `hypothesis` or `investigating`) |
|
|
62
|
+
| `CaseAdd` | Open a case (`title` + `disproveIf` required; start as `hypothesis` or `investigating`) |
|
|
58
63
|
| `CaseUpdate` | Evidence, impact, severity, status (not direct confirm) |
|
|
59
|
-
| `
|
|
64
|
+
| `EvidenceAdd` | Role-typed, hashed evidence item on a case (refutation justifies kills; cleanup tracks cleanup) |
|
|
65
|
+
| `PromoteFinding` | Run on-disk PoC (Docker sandbox by default; `local:true` for host) → confirm on exit 0 + marker; `control_path` required for live findings |
|
|
60
66
|
| `CaseGet` / `CaseList` / `CaseSearch` | Read / filter / search |
|
|
61
67
|
| `CaseLink` / `CaseUnlink` | Bidirectional exploit chains |
|
|
68
|
+
| `ChainSuggest` | Scan cases for exploitable chain combinations (credential+endpoint→ATO, redirect+OAuth→token theft, XSS+state-change→CSRF, IDOR+user-data, SSTI→RCE, race+payment, info-disclosure+SSRF), ranked by confidence |
|
|
69
|
+
| `CoverageAdd` | Record a tested (asset × attack-class) cell — `scope: wide` (deployment-wide verdict, applies to every later asset) or `local`; both found and clean results count |
|
|
70
|
+
| `CoverageReport` | Render the machine-checkable coverage matrix (which classes are tested where; plateau claims must match it) |
|
|
62
71
|
| `CaseContext` | Context bundle for a confirmed/reported case (full record, logs, links, artifacts) + report path |
|
|
63
72
|
|
|
64
73
|
Commands: `/casefile` (dashboard), `/xp` (XP mode).
|