@xaccefy/pi-casefile 0.9.2 → 0.9.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xaccefy/pi-casefile",
-  "version": "0.9.2",
+  "version": "0.9.3",
   "description": "Offensive security case tracker for Pi Agent — bug bounties, CTFs, security audits",
   "keywords": [
     "pi-package",
@@ -49,7 +49,7 @@
   ],
   "main": "src/index.ts",
   "dependencies": {
-    "@xaccefy/pi-shared": "0.9.2",
+    "@xaccefy/pi-shared": "0.9.3",
     "undici": "^8.9.0"
   },
   "pi": {

package/src/evidence.ts

@@ -45,6 +45,14 @@ export type PoCEvidence = {
     expect: VerifyExpect;
     /** Optional stronger causality dimension, independent of the authored predicate. */
     canary?: VerifyCanary;
+    /**
+     * Differential shape. "inter_host" (default) = same request to target vs a
+     * distinct patched control host (body-carried proof). "intra_target" = attack
+     * request vs a legitimate same-host `baseline` request (access-control /
+     * business-logic classes, where the discriminating variable is identity or a
+     * parameter, not the host) — requires `baseline`.
+     */
+    mode?: "inter_host" | "intra_target";
   };
   /** What the script itself saw — corroboration only, never proof. */
   observations: string[];
@@ -253,6 +261,19 @@ export function parsePoCEvidence(
       };
     }
   }
+  if (verify.mode !== undefined && verify.mode !== "inter_host" && verify.mode !== "intra_target") {
+    return {
+      ok: false,
+      error: 'evidence.json verify.mode must be "inter_host" or "intra_target"',
+    };
+  }
+  if (verify.mode === "intra_target" && !isRecord(raw.baseline)) {
+    return {
+      ok: false,
+      error:
+        "evidence.json verify.mode intra_target requires baseline — a legitimate same-host request whose response must NOT satisfy the attack predicate",
+    };
+  }
   const expect = verify.expect;
   if (!isRecord(expect))
     return { ok: false, error: "evidence.json verify.expect must be an object" };

package/src/harness-verify.ts

@@ -543,6 +543,29 @@ async function replayRequest(
   return { attempted: true, url: observedUrl(), note: "unreachable redirect state" };
 }
 
+/**
+ * Two requests are "the same" when method, URL, header set, and body all match.
+ * An intra-target differential whose attack and baseline are identical proves
+ * nothing — the discriminating variable must actually differ.
+ */
+export function sameRequest(
+  a: { method: string; url: string; headers?: Record<string, string>; body?: string },
+  b: { method: string; url: string; headers?: Record<string, string>; body?: string },
+): boolean {
+  const norm = (h?: Record<string, string>) =>
+    JSON.stringify(
+      Object.entries(h ?? {})
+        .map(([k, v]) => [k.toLowerCase(), v] as const)
+        .sort(([x], [y]) => (x < y ? -1 : x > y ? 1 : 0)),
+    );
+  return (
+    a.method.toUpperCase() === b.method.toUpperCase() &&
+    a.url === b.url &&
+    (a.body ?? "") === (b.body ?? "") &&
+    norm(a.headers) === norm(b.headers)
+  );
+}
+
 function injectCanary(
   verify: PoCEvidence["verify"],
   token: string | undefined,
@@ -612,6 +635,49 @@ export async function replayVerify(
   };
 }
 
+/**
+ * Combine the two observations into the differential verdict. Shared by the
+ * inter-host (target vs control host) and intra-target (attack vs same-host
+ * baseline) replays — only the note labels differ.
+ */
+function judgeDifferential(
+  target: HarnessResponseObservation,
+  control: HarnessResponseObservation,
+  token: string | undefined,
+  label: { kind: string; a: string; b: string },
+): HarnessVerifyResult {
+  const attempted = target.attempted && control.attempted;
+  const conclusive = target.matched !== undefined && control.matched !== undefined;
+  const differential = conclusive
+    ? target.matched === true
+      ? control.matched === true
+        ? "both"
+        : "target_only"
+      : control.matched === true
+        ? "control_only"
+        : "neither"
+    : undefined;
+  const canary = canaryResult(token, target, control);
+  const pass =
+    attempted &&
+    conclusive &&
+    differential === "target_only" &&
+    (canary === undefined || canary.pass === true);
+  return {
+    attempted,
+    pass,
+    status: target.status,
+    target,
+    control,
+    differential,
+    canary,
+    proofStrength: canary?.pass ? "canary_differential" : "predicate_differential",
+    note:
+      `harness ${label.kind} ${differential ?? "inconclusive"}: ${label.a} (${target.note}); ` +
+      `${label.b} (${control.note})${canary ? `; ${canary.note}` : ""}`,
+  };
+}
+
 /**
  * Execute one harness-owned request template against both the case target and
  * a distinct control origin. The PoC cannot weaken the control request: the
@@ -658,36 +724,75 @@ export async function replayDifferential(
     token,
     opts,
   );
-  const attempted = target.attempted && control.attempted;
-  const conclusive = target.matched !== undefined && control.matched !== undefined;
-  const targetMatched = target.matched === true;
-  const controlMatched = control.matched === true;
-  const differential = conclusive
-    ? targetMatched
-      ? controlMatched
-        ? "both"
-        : "target_only"
-      : controlMatched
-        ? "control_only"
-        : "neither"
+  return judgeDifferential(target, control, token, {
+    kind: "differential",
+    a: "target",
+    b: "control",
+  });
+}
+
+/**
+ * Same-host differential (Tier 2, intra-target). For access-control and
+ * business-logic classes the discriminating variable is the attacker's
+ * identity or a request parameter, NOT the host — so the sound baseline is a
+ * legitimate request to the SAME target, not the same request to another host.
+ * The harness sends the attack request and the model-declared `evidence.baseline`
+ * request to the case target, applies the attack's `verify.expect` predicates to
+ * BOTH responses, and passes only when the proof appears on the attack response
+ * and is absent from the baseline (`target_only`, where "target" = attack and
+ * "control" = baseline). The baseline is bound to the case target so it cannot
+ * be redirected to a weaker origin, and it must differ from the attack request.
+ */
+export async function replayIntraTarget(
+  evidence: PoCEvidence,
+  caseTarget: string,
+  opts?: ReplayOptions,
+): Promise<HarnessVerifyResult> {
+  const baseline = evidence.baseline;
+  if (!baseline) {
+    return {
+      attempted: false,
+      pass: false,
+      note: "intra-target differential requires evidence.baseline (a legitimate same-host request)",
+    };
+  }
+  const attackBinding = verifyUrlBindingError(evidence.verify.url, caseTarget);
+  if (attackBinding) {
+    return { attempted: false, pass: false, note: `attack binding failed: ${attackBinding}` };
+  }
+  const baselineBinding = verifyUrlBindingError(baseline.url, caseTarget);
+  if (baselineBinding) {
+    return { attempted: false, pass: false, note: `baseline binding failed: ${baselineBinding}` };
+  }
+  if (sameRequest(evidence.verify, baseline)) {
+    return {
+      attempted: false,
+      pass: false,
+      note: "attack and baseline requests are identical — an intra-target differential must vary identity or a parameter",
+    };
+  }
+
+  const token = evidence.verify.canary
+    ? `poc_canary_${randomBytes(24).toString("hex")}`
     : undefined;
-  const canary = canaryResult(token, target, control);
-  const pass =
-    attempted &&
-    conclusive &&
-    differential === "target_only" &&
-    (canary === undefined || canary.pass === true);
-  return {
-    attempted,
-    pass,
-    status: target.status,
-    target,
-    control,
-    differential,
-    canary,
-    proofStrength: canary?.pass ? "canary_differential" : "predicate_differential",
-    note:
-      `harness differential ${differential ?? "inconclusive"}: target (${target.note}); ` +
-      `control (${control.note})${canary ? `; ${canary.note}` : ""}`,
-  };
+  const attackVerify = injectCanary(evidence.verify, token);
+  const attack = await replayRequest(attackVerify, attackVerify.expect, token, opts);
+  // The baseline carries the attack's predicates: the proof must be ABSENT here.
+  const baselineVerify = injectCanary(
+    {
+      ...evidence.verify,
+      method: baseline.method,
+      url: baseline.url,
+      headers: baseline.headers,
+      body: baseline.body,
+    },
+    token,
+  );
+  const base = await replayRequest(baselineVerify, attackVerify.expect, token, opts);
+
+  return judgeDifferential(attack, base, token, {
+    kind: "intra-target",
+    a: "attack",
+    b: "baseline",
+  });
 }

package/src/index.ts

@@ -19,7 +19,12 @@ import {
   SEVERITY_MATCH_VALUES,
   validateMainAgentVerdict,
 } from "./evidence.ts";
-import { controlTargetAuthorizationError, replayDifferential } from "./harness-verify.ts";
+import {
+  controlTargetAuthorizationError,
+  type HarnessVerifyResult,
+  replayDifferential,
+  replayIntraTarget,
+} from "./harness-verify.ts";
 import {
   addCaseResult,
   addEvidenceItemResult,
@@ -198,11 +203,20 @@ const PromoteSchema = Type.Object(
           "Optional absolute path to the SAME script as poc_path (sha256-equality is ENFORCED). Defaults to poc_path. The harness runs it with PI_POC_MODE=control and PI_POC_TARGET=control_target.",
       }),
     ),
-    control_target: Type.String({
-      minLength: 1,
-      description:
-        "REQUIRED: a distinct baseline target that lacks the vulnerability and is operator-approved through PI_POC_CONTROL_TARGETS (patched replica, second account, baseline service).",
-    }),
+    mode: Type.Optional(
+      Type.String({
+        enum: ["inter_host", "intra_target"],
+        description:
+          "Differential shape. 'inter_host' (default) proves target-dependence with a distinct patched control host — for body-carried proof (file read, injection exfil, info leak, reflection). 'intra_target' proves it with a legitimate same-host baseline request declared in the evidence — for access-control / business-logic classes (IDOR, auth bypass, privilege escalation, logic flaws) where the discriminating variable is identity or a parameter, not the host. In intra_target the evidence must set verify.mode='intra_target' and include a baseline; control_target/control_path are not used.",
+      }),
+    ),
+    control_target: Type.Optional(
+      Type.String({
+        minLength: 1,
+        description:
+          "REQUIRED for mode='inter_host': a distinct baseline target that lacks the vulnerability and is operator-approved through PI_POC_CONTROL_TARGETS (patched replica, second account, baseline service). Not used for mode='intra_target'.",
+      }),
+    ),
     local: Type.Optional(
       Type.Boolean({
         description:
@@ -1181,22 +1195,30 @@ export default function casefileExtension(pi: ExtensionAPI) {
         const pocPath = (params.poc_path as string | undefined)?.trim() ?? "";
         const controlPath = (params.control_path as string | undefined)?.trim() || pocPath;
         const controlTarget = (params.control_target as string | undefined)?.trim() ?? "";
+        const mode: "inter_host" | "intra_target" =
+          (params.mode as string | undefined) === "intra_target" ? "intra_target" : "inter_host";
+        const isIntra = mode === "intra_target";
         if (!pocPath) {
           return fail("poc_path is REQUIRED: absolute path to the PoC script run by the harness.", {
             missingPocPath: true,
           });
         }
-        if (!controlTarget) {
-          return fail(
-            "control_target is REQUIRED: a distinct baseline target that lacks the vulnerability.",
-            { missingControlTarget: true },
-          );
-        }
-        if (controlTarget === current.target) {
-          return fail(
-            "control_target must differ from the case target; a control run against the vulnerable target proves nothing.",
-            { controlTargetEqualsCaseTarget: true },
-          );
+        // Control-target preconditions apply only to the inter-host differential.
+        // Intra-target proves target-dependence with a same-host baseline request
+        // carried in the evidence, so it needs no control target or control script.
+        if (!isIntra) {
+          if (!controlTarget) {
+            return fail(
+              "control_target is REQUIRED for inter-host mode: a distinct baseline target that lacks the vulnerability. For access-control/logic bugs use mode='intra_target' with an evidence baseline instead.",
+              { missingControlTarget: true },
+            );
+          }
+          if (controlTarget === current.target) {
+            return fail(
+              "control_target must differ from the case target; a control run against the vulnerable target proves nothing.",
+              { controlTargetEqualsCaseTarget: true },
+            );
+          }
         }
         if (params.local === true && process.env.PI_POC_ALLOW_NETWORK !== "1") {
           return fail(
@@ -1204,33 +1226,43 @@ export default function casefileExtension(pi: ExtensionAPI) {
             { networkNotAuthorized: true },
           );
         }
-        const controlAuthorization = controlTargetAuthorizationError(controlTarget);
-        if (controlAuthorization) {
-          return fail(
-            `CONTROL AUTHORIZATION FAILED: ${controlAuthorization}. ` +
-              "The operator must set PI_POC_CONTROL_TARGETS to the exact approved control host/origin before this control can anchor confirmation.",
-            { controlNotAuthorized: true },
-          );
+        if (!isIntra) {
+          const controlAuthorization = controlTargetAuthorizationError(controlTarget);
+          if (controlAuthorization) {
+            return fail(
+              `CONTROL AUTHORIZATION FAILED: ${controlAuthorization}. ` +
+                "The operator must set PI_POC_CONTROL_TARGETS to the exact approved control host/origin before this control can anchor confirmation.",
+              { controlNotAuthorized: true },
+            );
+          }
         }
 
-        // Same-file contract (anti-cheat): control must be the SAME bytes as the
-        // PoC, differing only via the harness-set env. Check BEFORE any run.
+        // Anti-cheat: hash the PoC (always) and, for inter-host, require the
+        // control script to be the SAME bytes (differing only via harness env).
         let pocHash: string | undefined;
-        let controlHash: string | undefined;
         try {
           pocHash = createHash("sha256").update(readFileSync(pocPath)).digest("hex");
-          controlHash = createHash("sha256").update(readFileSync(controlPath)).digest("hex");
         } catch (e) {
-          return fail(
-            `Cannot read PoC/control scripts for the same-file check: ${(e as Error).message}`,
-            { sameFileCheckFailed: true },
-          );
+          return fail(`Cannot read PoC script: ${(e as Error).message}`, {
+            sameFileCheckFailed: true,
+          });
         }
-        if (pocHash !== controlHash) {
-          return fail(
-            "CONTROL CHECK FAILED: control_path must be the SAME script as poc_path (sha256 mismatch). Case remains investigating.",
-            { controlHashMismatch: true },
-          );
+        if (!isIntra) {
+          let controlHash: string | undefined;
+          try {
+            controlHash = createHash("sha256").update(readFileSync(controlPath)).digest("hex");
+          } catch (e) {
+            return fail(
+              `Cannot read control script for the same-file check: ${(e as Error).message}`,
+              { sameFileCheckFailed: true },
+            );
+          }
+          if (pocHash !== controlHash) {
+            return fail(
+              "CONTROL CHECK FAILED: control_path must be the SAME script as poc_path (sha256 mismatch). Case remains investigating.",
+              { controlHashMismatch: true },
+            );
+          }
         }
 
         // ── OOB callback (Tier 1, opt-in for blind classes) ──
@@ -1251,12 +1283,11 @@ export default function casefileExtension(pi: ExtensionAPI) {
         });
 
         const caseTarget = current.target ?? "";
-        // Determinism: TWO target runs + one control run. Exit 0 is run
-        // integrity only; nonce-bound body evidence and the harness-owned
-        // target/control replay form the machine gate.
+        // Determinism: TWO target runs. Exit 0 is run integrity only; nonce-bound
+        // body evidence plus the harness-owned differential replay (inter-host
+        // control, or intra-target same-host baseline) form the machine gate.
         const run1 = runPoc(pocPath, runOptions("poc", caseTarget));
         const run2 = runPoc(pocPath, runOptions("poc", caseTarget));
-        const controlRun = runPoc(controlPath, runOptions("control", controlTarget));
 
         const evidenceRun = (
           r: PocRun,
@@ -1304,28 +1335,55 @@ export default function casefileExtension(pi: ExtensionAPI) {
           evidenceRun(run1, "poc", caseTarget),
           evidenceRun(run2, "poc", caseTarget),
         ];
-        const control = evidenceRun(controlRun, "control", controlTarget);
-
-        // Tier 2 (docs/poc-trust-model.md): the harness executes the SAME
-        // request template against target and operator-approved control, applying
-        // the target's predicates to both. DNS is pinned at connect time.
-        const harnessVerified = await replayDifferential(
-          targetRuns[0].evidence,
-          caseTarget,
-          controlTarget,
-          { allowPrivate: process.env.PI_POC_ALLOW_PRIVATE_REPLAY === "1" },
-        );
 
+        const allowPrivateReplay = process.env.PI_POC_ALLOW_PRIVATE_REPLAY === "1";
+        let harnessVerified: HarnessVerifyResult;
+        let controlRun: PocEvidenceRun | undefined;
+        if (isIntra) {
+          // Intra-target: prove target-dependence with the evidence's same-host
+          // baseline request — no separate control run. The harness sends attack +
+          // baseline to the case target and requires the proof on attack only.
+          const ev0 = targetRuns[0].evidence;
+          if (ev0.verify.mode !== "intra_target") {
+            return fail(
+              "INTRA-TARGET FAILED: the PoC's evidence.json must set verify.mode='intra_target' when promoting in intra-target mode.",
+              { intraModeMismatch: true },
+            );
+          }
+          if (!ev0.baseline) {
+            return fail(
+              "INTRA-TARGET FAILED: evidence.json must include a baseline — a legitimate same-host request whose response must NOT satisfy the attack predicate.",
+              { intraBaselineMissing: true },
+            );
+          }
+          harnessVerified = await replayIntraTarget(ev0, caseTarget, {
+            allowPrivate: allowPrivateReplay,
+          });
+        } else {
+          // Inter-host (Tier 2): the harness executes the SAME request template
+          // against target and operator-approved control, applying the target's
+          // predicates to both. DNS is pinned at connect time.
+          controlRun = evidenceRun(
+            runPoc(controlPath, runOptions("control", controlTarget)),
+            "control",
+            controlTarget,
+          );
+          harnessVerified = await replayDifferential(
+            targetRuns[0].evidence,
+            caseTarget,
+            controlTarget,
+            { allowPrivate: allowPrivateReplay },
+          );
+        }
         const bundle: PendingConfirmation = {
           caseId,
           ranAt: new Date().toISOString(),
           pocPath,
           pocSha256: pocHash,
-          controlPath,
-          controlTarget,
+          mode,
           targetRuns,
-          controlRun: control,
           harnessVerified,
+          ...(isIntra ? {} : { controlPath, controlTarget, controlRun }),
         };
 
         let record: CaseRecord;
@@ -1343,11 +1401,11 @@ export default function casefileExtension(pi: ExtensionAPI) {
               type: "text",
               text:
                 `Phase 1 complete — evidence bundle recorded on ${caseId} (expires in 1h).\n` +
-                `Target runs: 2, Control run: 1 — all with validated nonce-bound evidence.json.\n` +
+                `Mode: ${mode}. ${isIntra ? "Target runs: 2, same-host baseline differential" : "Target runs: 2, Control run: 1"} — all with validated nonce-bound evidence.json.\n` +
                 `Evidence sha256: ${targetRuns[0].evidenceSha256}\n` +
                 `PoC script sha256 (at run time): ${pocHash}\n` +
                 `Harness verify replay: ${harnessVerified.attempted ? (harnessVerified.pass ? `PASS (status ${harnessVerified.status})` : `FAILED — ${harnessVerified.note}`) : harnessVerified.note}\n` +
-                `\nMAIN-AGENT REVIEW REQUIRED (do not delegate): inspect case ${caseId}, PoC ${pocPath}, control ${controlTarget}, evidence ${targetRuns[0].evidenceSha256}, and PoC hash ${pocHash}. Hunt for a trivial predicate or fabricated differential and perform a concrete disconfirmation attempt, then call ConfirmFinding yourself. A CONFIRMED call performs and stores a fresh harness-owned target/control replay; NOT_CONFIRMED keeps the case investigating.`,
+                `\nMAIN-AGENT REVIEW REQUIRED (do not delegate): inspect case ${caseId}, PoC ${pocPath}, ${isIntra ? "same-host baseline" : `control ${controlTarget}`}, evidence ${targetRuns[0].evidenceSha256}, and PoC hash ${pocHash}. Hunt for a trivial predicate or fabricated differential and perform a concrete disconfirmation attempt, then call ConfirmFinding yourself. A CONFIRMED call performs and stores a fresh harness-owned ${isIntra ? "attack/baseline" : "target/control"} replay; NOT_CONFIRMED keeps the case investigating.`,
             },
           ],
           details: {
@@ -1355,9 +1413,10 @@ export default function casefileExtension(pi: ExtensionAPI) {
             bundle: {
               caseId,
               ranAt: bundle.ranAt,
+              mode,
               pocPath,
-              controlPath,
-              controlTarget,
+              controlPath: isIntra ? undefined : controlPath,
+              controlTarget: isIntra ? undefined : controlTarget,
               pocSha256: pocHash,
               evidenceSha256: targetRuns[0].evidenceSha256,
               harnessVerified,
@@ -1426,16 +1485,29 @@ export default function casefileExtension(pi: ExtensionAPI) {
           if (!bundle) {
             throw new Error("No pending confirmation on this case — run PromoteFinding first");
           }
-          const controlAuthorizationError = controlTargetAuthorizationError(bundle.controlTarget);
-          if (controlAuthorizationError) {
-            throw new Error(`CONTROL AUTHORIZATION FAILED: ${controlAuthorizationError}`);
+          const allowPrivate = process.env.PI_POC_ALLOW_PRIVATE_REPLAY === "1";
+          const caseTargetForReplay = current.target ?? bundle.targetRuns[0].target;
+          let replay: HarnessVerifyResult;
+          if (bundle.mode === "intra_target") {
+            // Same-host attack-vs-baseline replay; no control target to authorize.
+            replay = await replayIntraTarget(bundle.targetRuns[0].evidence, caseTargetForReplay, {
+              allowPrivate,
+            });
+          } else {
+            if (!bundle.controlTarget) {
+              throw new Error("inter-host confirmation requires a control target");
+            }
+            const controlAuthorizationError = controlTargetAuthorizationError(bundle.controlTarget);
+            if (controlAuthorizationError) {
+              throw new Error(`CONTROL AUTHORIZATION FAILED: ${controlAuthorizationError}`);
+            }
+            replay = await replayDifferential(
+              bundle.targetRuns[0].evidence,
+              caseTargetForReplay,
+              bundle.controlTarget,
+              { allowPrivate },
+            );
           }
-          const replay = await replayDifferential(
-            bundle.targetRuns[0].evidence,
-            current.target ?? bundle.targetRuns[0].target,
-            bundle.controlTarget,
-            { allowPrivate: process.env.PI_POC_ALLOW_PRIVATE_REPLAY === "1" },
-          );
           phase2Verification = {
             at: new Date().toISOString(),
             result: replay,

package/src/ledger.ts

@@ -31,7 +31,7 @@ import {
   parsePoCEvidence,
   validateMainAgentVerdict,
 } from "./evidence.ts";
-import { type HarnessVerifyResult, verifyUrlBindingError } from "./harness-verify.ts";
+import { type HarnessVerifyResult, sameRequest, verifyUrlBindingError } from "./harness-verify.ts";
 import {
   assertSafeRegularFile,
   ensureSafeStateDirectory,
@@ -328,10 +328,21 @@ export type PendingConfirmation = {
   pocPath: string;
   /** SHA-256 of the PoC script AT RUN TIME — re-hashed at confirm to catch edits. */
   pocSha256: string;
-  controlPath: string;
-  controlTarget: string;
+  /**
+   * Differential shape. Absent/"inter_host" (default) = same request to target
+   * vs a distinct patched control host, proven by a separate control run +
+   * `replayDifferential`. "intra_target" = attack vs a legitimate same-host
+   * `baseline` request inside each run's evidence, proven by `replayIntraTarget`
+   * — no control run or control target (access-control / business-logic classes).
+   */
+  mode?: "inter_host" | "intra_target";
+  /** inter_host only. */
+  controlPath?: string;
+  /** inter_host only. */
+  controlTarget?: string;
   targetRuns: [PocEvidenceRun, PocEvidenceRun];
-  controlRun: PocEvidenceRun;
+  /** inter_host only — the same PoC run against the control target. */
+  controlRun?: PocEvidenceRun;
   /** Harness's own replay of evidence.verify (public targets). Absent = legacy bundle. */
   harnessVerified?: HarnessVerifyResult;
   /** Harness-owned OOB listener log for the run (opt-in blind classes). */
@@ -2064,13 +2075,19 @@ function validateRunEvidence(run: PocEvidenceRun, label: string): void {
 }
 
 /** Determinism + differential on normalized evidence (nonce/observations stripped). */
-function assertEvidenceDifferential(bundle: PendingConfirmation): void {
+function assertEvidenceDifferential(bundle: PendingConfirmation, isIntra = false): void {
   const [r1, r2] = bundle.targetRuns;
   if (normalizeEvidence(r1.evidence) !== normalizeEvidence(r2.evidence)) {
     throw new Error(
       "Target runs produced inconsistent evidence — the exploit did not reproduce deterministically",
     );
   }
+  // Intra-target target-dependence is proven by the harness attack-vs-baseline
+  // replay (same host), not by comparing a target run to a separate control run.
+  if (isIntra) return;
+  if (!bundle.controlRun) {
+    throw new Error("inter-host confirmation requires a control run");
+  }
   if (normalizeEvidence(r1.evidence) === normalizeEvidence(bundle.controlRun.evidence)) {
     throw new Error(
       "Control run produced identical evidence to the target — the claimed impact is not target-dependent",
@@ -2143,6 +2160,7 @@ function assertHarnessCanary(
 function assertMainAgentVerification(
   bundle: PendingConfirmation,
   verification: MainAgentVerification | undefined,
+  isIntra = false,
 ): asserts verification is MainAgentVerification {
   if (!verification) {
     throw new Error(
@@ -2179,8 +2197,16 @@ function assertMainAgentVerification(
   if (!targetUrl || verifyUrlBindingError(targetUrl, targetIdentity)) {
     throw new Error("MAIN-AGENT REPLAY FAILED: target transcript is not bound to the case target");
   }
-  if (!controlUrl || verifyUrlBindingError(controlUrl, bundle.controlTarget)) {
-    throw new Error("MAIN-AGENT REPLAY FAILED: control transcript is not bound to control_target");
+  // Intra-target: the "control" transcript is the legitimate baseline request,
+  // which is bound to the SAME case target. Inter-host: it is bound to the
+  // distinct control target.
+  const controlBindTarget = isIntra ? targetIdentity : bundle.controlTarget;
+  if (!controlUrl || !controlBindTarget || verifyUrlBindingError(controlUrl, controlBindTarget)) {
+    throw new Error(
+      isIntra
+        ? "MAIN-AGENT REPLAY FAILED: baseline transcript is not bound to the case target"
+        : "MAIN-AGENT REPLAY FAILED: control transcript is not bound to control_target",
+    );
   }
 }
 
@@ -2230,6 +2256,75 @@ export function assertPromotable(id: string): CaseRecord {
   return current;
 }
 
+/**
+ * Phase 1 (intra-target): validate a same-host attack-vs-baseline bundle. The
+ * differential is proven by the harness replay (attack matched, baseline did
+ * not, both against the case target), not by a separate control run — the
+ * discriminating variable is the request's identity or a parameter, not the host.
+ */
+function validateIntraTargetBundle(
+  current: CaseRecord,
+  id: string,
+  bundle: PendingConfirmation,
+): CaseRecord {
+  if (bundle.targetRuns.length !== 2) {
+    throw new Error("Intra-target confirmation requires two target runs");
+  }
+  if (bundle.controlRun || bundle.controlTarget) {
+    throw new Error(
+      "Intra-target confirmation must not carry a control run or control target — the baseline is a same-host request inside the evidence",
+    );
+  }
+  const targetRunTarget = bundle.targetRuns[0]?.target;
+  if (!targetRunTarget || bundle.targetRuns.some((r) => r.target !== targetRunTarget)) {
+    throw new Error("Intra-target confirmation requires both runs against the same case target");
+  }
+  let pocHash: string | undefined;
+  try {
+    pocHash = createHash("sha256").update(readFileSync(bundle.pocPath)).digest("hex");
+  } catch {
+    pocHash = undefined;
+  }
+  if (!pocHash || (bundle.pocSha256 && bundle.pocSha256 !== pocHash)) {
+    throw new Error("pocSha256 does not match the PoC file on disk");
+  }
+  for (const run of bundle.targetRuns) {
+    validateRunEvidence(run, `${run.mode} run`);
+    const ev = run.evidence;
+    if (ev.verify.mode !== "intra_target") {
+      throw new Error(
+        "INTRA-TARGET FAILED: each run's evidence.verify.mode must be 'intra_target'",
+      );
+    }
+    if (!ev.baseline) {
+      throw new Error(
+        "INTRA-TARGET FAILED: evidence.baseline (a legitimate same-host request) is required",
+      );
+    }
+    const attackBinding = verifyUrlBindingError(ev.verify.url, targetRunTarget);
+    if (attackBinding) throw new Error(`ATTACK BINDING FAILED: ${attackBinding}`);
+    const baselineBinding = verifyUrlBindingError(ev.baseline.url, targetRunTarget);
+    if (baselineBinding) throw new Error(`BASELINE BINDING FAILED: ${baselineBinding}`);
+    if (ev.baseline && sameRequest(ev.verify, ev.baseline)) {
+      throw new Error(
+        "INTRA-TARGET FAILED: attack and baseline requests are identical — vary identity or a parameter",
+      );
+    }
+  }
+  if (bundle.caseId !== id) throw new Error("Pending confirmation caseId mismatch");
+  assertEvidenceDifferential(bundle, true);
+  // Machine floor: attack matched, baseline did not, both against the case target.
+  assertMachineConfirmation(bundle);
+  assertHarnessCanary(
+    bundle.harnessVerified,
+    bundle.targetRuns[0].evidence.verify.canary !== undefined,
+    "PHASE-1 CANARY FAILED",
+  );
+  const next = buildRecord({ pendingConfirmation: bundle }, current);
+  validateCase(next);
+  return next;
+}
+
 /**
  * Phase 1: record the harness-observed evidence bundle on the case. The whole
  * contract is validated here — same-file control, nonce binding, run
@@ -2248,6 +2343,11 @@ export function storePendingConfirmation(id: string, bundle: PendingConfirmation
       );
     }
     if (bundle.caseId !== id) throw new Error("Pending confirmation caseId mismatch");
+    if (bundle.mode === "intra_target") {
+      const next = validateIntraTargetBundle(current, id, bundle);
+      upsertCase(db, next);
+      return next;
+    }
     if (bundle.targetRuns.length !== 2 || !bundle.controlRun) {
       throw new Error("Pending confirmation requires two target runs and one control run");
     }
@@ -2423,10 +2523,14 @@ export function applyConfirmationResult(
 
     // CONFIRMED — re-validate the whole bundle (defense in depth; the case may
     // have been touched between phase 1 and the verdict).
-    for (const run of [...bundle.targetRuns, bundle.controlRun]) {
+    const isIntra = bundle.mode === "intra_target";
+    const allRuns = isIntra
+      ? [...bundle.targetRuns]
+      : [...bundle.targetRuns, ...(bundle.controlRun ? [bundle.controlRun] : [])];
+    for (const run of allRuns) {
       validateRunEvidence(run, `${run.mode} run`);
     }
-    assertEvidenceDifferential(bundle);
+    assertEvidenceDifferential(bundle, isIntra);
     assertMachineConfirmation(bundle);
     assertHarnessCanary(bundle.harnessVerified, canaryRequested, "PHASE-1 CANARY FAILED");
     let pocHash: string | undefined;
@@ -2450,7 +2554,7 @@ export function applyConfirmationResult(
           `(bundle target: ${targetRun.target}, case target: ${current.target ?? "(none)"}).`,
       );
     }
-    if (current.target === bundle.controlTarget) {
+    if (!isIntra && current.target === bundle.controlTarget) {
       throw new Error(
         "Case target now equals the control target — the claimed impact is not target-dependent; " +
           "re-run PromoteFinding with a distinct control_target.",
@@ -2469,7 +2573,7 @@ export function applyConfirmationResult(
     // Phase 1 proves the evidence floor. Phase 2 must freshly replay that same
     // request inside the main agent's ConfirmFinding call; a caller-provided
     // boolean is not accepted as proof of re-execution.
-    assertMainAgentVerification(bundle, phase2Verification);
+    assertMainAgentVerification(bundle, phase2Verification, isIntra);
 
     const reproductionItem: EvidenceItem = {
       id: `ev_${stableShortId(`${id}\nreproduction\n${targetRun.ranAt}`)}`,
@@ -2480,7 +2584,7 @@ export function applyConfirmationResult(
       // exists, so the item stays artifact-backed and re-verifiable.
       artifactPath: targetRun.evidencePath ? basename(targetRun.evidencePath) : "evidence.json",
       sha256: targetRun.evidenceSha256,
-      summary: `PoC evidence accepted (2 target runs + control; ${recorded.proofStrength}) — main agent semantic confirmation${verdict.model ? ` (${verdict.model})` : ""}`,
+      summary: `PoC evidence accepted (2 target runs + ${isIntra ? "same-host baseline" : "control"}; ${recorded.proofStrength}) — main agent semantic confirmation${verdict.model ? ` (${verdict.model})` : ""}`,
       createdAt: targetRun.ranAt,
     };
 
@@ -2506,17 +2610,30 @@ export function applyConfirmationResult(
         mode: "poc",
         target: targetRun.target,
       },
-      controlVerified: {
-        path: bundle.controlPath,
-        exitCode: bundle.controlRun.exitCode,
-        ranAt: bundle.controlRun.ranAt,
-        output: bundle.controlRun.output,
-        sandbox: bundle.controlRun.sandbox,
-        completed: true,
-        outputComplete: true,
-        mode: "control",
-        target: bundle.controlRun.target,
-      },
+      controlVerified:
+        isIntra || !bundle.controlRun
+          ? {
+              path: bundle.pocPath,
+              exitCode: targetRun.exitCode,
+              ranAt: targetRun.ranAt,
+              output: `intra-target baseline (same host): ${bundle.harnessVerified?.control?.note ?? "baseline did not satisfy the attack predicate"}`,
+              sandbox: targetRun.sandbox,
+              completed: true,
+              outputComplete: true,
+              mode: "baseline",
+              target: targetRun.target,
+            }
+          : {
+              path: bundle.controlPath ?? bundle.pocPath,
+              exitCode: bundle.controlRun.exitCode,
+              ranAt: bundle.controlRun.ranAt,
+              output: bundle.controlRun.output,
+              sandbox: bundle.controlRun.sandbox,
+              completed: true,
+              outputComplete: true,
+              mode: "control",
+              target: bundle.controlRun.target,
+            },
       disconfirmation: verdict.disconfirmation_attempt,
       confirmerVerdict: recorded,
       pendingConfirmation: undefined,

package/src/workflow.ts

@@ -84,6 +84,15 @@ ${d.reference}
 
 **Swarm delegation boundary:** only auditor (HUNT rounds), tracer (TRACE), skeptic (high-confidence challenge), and chain (CHAIN) run as subagents. You, the main coordinator, own RECON, VALIDATE/PoC writing, ConfirmFinding, patching, final reports, state decisions, and all orchestration.
 
+## Dispatch Discipline (fewer calls, batched, verifier-in-the-loop)
+
+This pipeline is SEQUENTIAL-dependent: each stage consumes the previous stage's output, so only HUNT genuinely fans out. Do NOT scatter one async subagent call per finding — that pays full coordination cost for no parallel payoff and turns you into a message router. Two rules keep it cheap:
+
+1. **Two dispatch points, each ONE batched call.** (a) **HUNT** — one call whose \`runs.all\`/\`tasks\` carries ≤3 batched auditors (related classes grouped by surface/family). (b) **TRACE+SKEPTIC** — one call carrying a trace task per prioritized finding, plus a skeptic task for each \`confidence: high\` finding; batch the whole round in a single dispatch, never one dispatch per finding. RECON, VALIDATE/PoC, ConfirmFinding, CHAIN, and REPORT stay INLINE with you.
+2. **Barrier, then submit the whole batch in one pass.** Let the batched call return ALL of its results, then \`PipelineSubmit\` each output back-to-back before choosing the next stage. Do not interleave fresh dispatches with the delivery of a prior batch. A crash / timeout / unparseable / schema-invalid result for one item is a RETRY for THAT item in the next batch — never a verdict, never a reason to drop the stage.
+
+Every stage boundary is a \`PipelineSubmit\` gate (schema + pre-filter, in code): nothing advances on prose. This is the verifier-in-the-loop — the same principle the machine PoC gate applies at CONFIRMED, applied at every stage transition.
+
 ## Stage Machine (run in order — you are the coordinator)
 
 RECON (you, inline) → **HUNT** (2-3 batched auditor subagents) → TRACE (tracer for prioritized findings) → SKEPTIC (bounded high-risk review) → VALIDATE (you, inline) → CHAIN (chain subagent) → REPORT (you, inline)
@@ -192,7 +201,12 @@ Weak: "Tried to disprove. Could not." — insufficient.
 
 **Main-agent validation only:** do not dispatch validation. You write the smallest reliable PoC that demonstrates the **maximum reachable impact** of the vulnerability, set the case's poc/evidence/impact/severity/target fields, and run PromoteFinding yourself. "Smallest" means no fragile ceremony, mocks, or unrelated exploit steps — not a weaker impact demonstration. Do not stop at a benign marker if a stronger in-scope, non-destructive primitive is reachable (read/write, privilege change, account takeover path, data exposure, etc.). If the PoC fails, refine it yourself up to the local budget; if proof cannot meet the gate, kill or keep the case investigating with the exact blocker.
 
-**PromoteFinding (phase 1) — evidence bundle, not markers.** Call it with \`poc_path\`, an operator-approved \`control_target\` from \`PI_POC_CONTROL_TARGETS\`, optional same-byte \`control_path\` (defaults to \`poc_path\`), and \`local: true\` when the bug needs network. Every run must complete with fully captured output and write nonce-bound \`evidence.json\` whose \`expect\` includes \`body_contains\` or \`body_regex\`; status-only evidence is rejected. The harness pins DNS at connect time, keeps redirects on the bound host, sends the same request to target/control, and requires two conclusive responses with \`target_only\`. Private replay requires operator authorization. Blind/OOB classes fail closed until a source-separated oracle exists.
+**PromoteFinding (phase 1) — evidence bundle, not markers.** Pick the differential \`mode\` that fits the class:
+
+- **\`mode: "inter_host"\` (default)** — body-carried proof that is the same on any host (file read, injection exfil, info leak, reflection). Call with \`poc_path\`, an operator-approved \`control_target\` from \`PI_POC_CONTROL_TARGETS\`, optional same-byte \`control_path\` (defaults to \`poc_path\`), and \`local: true\` when the bug needs network. The harness sends the SAME request to target and control and requires \`target_only\`.
+- **\`mode: "intra_target"\`** — access-control and business-logic classes (IDOR/BOLA, auth bypass, privilege escalation, mass assignment, logic/price tampering) where the discriminating variable is the attacker's IDENTITY or a PARAMETER, not the host. A different host lacks the victim's object/state, so inter-host proves nothing. Instead the evidence declares \`verify.mode: "intra_target"\` and a \`baseline\` (a legitimate SAME-host request — the attacker's own object, a properly-authorized request, the field omitted); the harness sends attack + baseline to the case target and requires the proof on the attack response only. No \`control_target\`/\`control_path\`.
+
+Every run must complete with fully captured output and write nonce-bound \`evidence.json\` whose \`expect\` includes \`body_contains\` or \`body_regex\`; status-only evidence is rejected. The harness pins DNS at connect time and keeps redirects on the bound host. Private replay requires operator authorization. Blind/OOB classes fail closed until a source-separated oracle exists.
 
 **ConfirmFinding (phase 2) — main-agent-only commit.** After PromoteFinding succeeds, do not dispatch confirmation. The main/coordinator agent must inspect the exact PoC/evidence, hunt trivial predicates/fabrication, attempt disconfirmation, and call \`ConfirmFinding(case_id, verdict)\` itself. A CONFIRMED call performs and stores a fresh harness-owned target/control replay; a caller-supplied re-execution checkbox is not accepted. CONFIRMED requires \`re_execution_note\`, \`differential: "target_only"\`, and the main agent's \`disconfirmation_attempt\`. Worker processes are rejected. **Never \`CaseUpdate(status: "confirmed")\` directly.**
 
@@ -345,7 +359,7 @@ Write the final report as a self-contained markdown file at the report path Case
 - **No finding is confirmed until its target is verified in scope** per the program's scope instruction. Out-of-scope findings are killed, not confirmed.
 - **No finding is validated without a reachability trace** showing REACHABLE. UNREACHABLE requires a concrete blocker; unresolved auth/WAF/source ambiguity stays INVESTIGATING or BLOCKED, not killed.
 - **High-confidence findings: do your own adversarial disconfirmation.** No skeptic subagent in lite mode — actively try to disprove your own finding and document the attempt in \`disconfirmation\`. Failing to disprove is the expected outcome.
-- **Confirmed requires** evidence + poc + impact + severity + target + disconfirmation, via the two-phase gate: **PromoteFinding** with same-script target/control execution and an operator-approved \`control_target\`; then you, the main agent, inspect the bundle, attempt disconfirmation, and call **ConfirmFinding** yourself. That call captures a fresh second target/control replay before commit. Do not delegate validation or confirmation. The machine gate requires zero-exit complete runs, nonce binding, body evidence, determinism, DNS-pinned conclusive \`target_only\` replay, and script identity; zero exit is never proof and markers are diagnostic only. \`local:true\` and private replay remain operator-gated. No mocks and no direct \`CaseUpdate(status: "confirmed")\`.
+- **Confirmed requires** evidence + poc + impact + severity + target + disconfirmation, via the two-phase gate: **PromoteFinding** in the differential \`mode\` that fits the class — \`inter_host\` (default) with an operator-approved \`control_target\` for body-carried proof (file read, injection exfil, info leak, reflection), or \`intra_target\` for access-control/logic classes (IDOR, auth bypass, privilege escalation, logic), where the evidence declares \`verify.mode:"intra_target"\` + a same-host \`baseline\` and the harness requires the proof on the attack response only (no control target). Then you, the main agent, inspect the bundle, attempt disconfirmation, and call **ConfirmFinding** yourself. That call captures a fresh second replay before commit. Do not delegate validation or confirmation. The machine gate requires zero-exit complete runs, nonce binding, body evidence, determinism, a DNS-pinned conclusive \`target_only\` differential, and script identity; zero exit is never proof and markers are diagnostic only. \`local:true\` and private replay remain operator-gated. No mocks and no direct \`CaseUpdate(status: "confirmed")\`.
 - **Severity is derived from proven PoC impact, not theory.** Demonstrate and claim the highest impact the attacker can actually reach; claiming less than a proven escalation is wrong, and over-claiming an unproven one gets the finding rejected at triage.
 - **Evidence-first:** every claim must be traceable to observed/reproduced behavior, source code, or documented platform behavior.
 - **Design & runtime check (mandatory before CONFIRMED):** actively search the target's docs, git history, changelog, and runtime/framework docs for evidence the behavior is BY DESIGN or already FIXED IN THE RUNTIME. Found it → KILL (\`intended_behavior\` / \`framework_protection\`), unless the documented intent is itself the flaw with real attacker impact. Not found → document the search in \`disconfirmation\` as non-intentionality proof.