@xaccefy/pi-casefile 0.9.3 → 0.10.0

package/src/index.ts

@@ -1,14 +1,14 @@
 /**
  * Casefile — offensive security case tracker for Pi.
  *
- * Tools: CaseAdd, CaseUpdate, PromoteFinding, ConfirmFinding, EvidenceAdd, CoverageAdd, CoverageReport, ChainSuggest, CaseGet, CaseList, CaseSearch, CaseLink, CaseUnlink, CaseContext, PipelineSubmit, ScratchpadInit, ScratchpadResume, ScratchpadCheckpoint, ScratchpadWrite, ScratchpadRead, ScratchpadPhaseDone, ScratchpadClear
+ * Tools: CaseAdd, CaseUpdate, PromoteFinding, ConfirmFinding, EvidenceAdd, CoverageAdd, CoverageReport, CaseGet, CaseList, CaseSearch, CaseLink, CaseUnlink, CaseContext, ScratchpadInit, ScratchpadResume, ScratchpadCheckpoint, ScratchpadWrite, ScratchpadRead, ScratchpadPhaseDone, ScratchpadClear
  * Command: /casefile — interactive dashboard
- * Event: before_agent_start — injects cyber workflow once per session, refreshes the active case list per prompt
+ * Event: before_agent_start — injects the recon workflow once per session, refreshes the active case list per prompt
  */
 
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
 import type { ExtensionAPI, ToolDefinition } from "@earendil-works/pi-coding-agent";
 import { matchesKey, Text, truncateToWidth } from "@earendil-works/pi-tui";
 import { type TSchema, Type } from "typebox";
@@ -55,6 +55,7 @@ import {
   LINK_KIND_VALUES,
   linkCasesResult,
   type MainAgentVerification,
+  type OobVerification,
   type PendingConfirmation,
   type PocEvidenceRun,
   PRIORITY_VALUES,
@@ -69,8 +70,14 @@ import {
   unlinkCasesResult,
   updateCaseResult,
 } from "./ledger.ts";
-import { suggestChainsAsync, writeCaseContextAsync } from "./ledger-worker.ts";
-import { pipeline_submit, SUBMIT_STAGES, type SubmitStage } from "./pipeline-submit.ts";
+import { writeCaseContext } from "./ledger.ts";
+import {
+  type OobOracleConfig,
+  type ProvisionedCallback,
+  provisionCallback,
+  readOobOracleConfig,
+  verifyOobDifferential,
+} from "./oob-oracle.ts";
 import { type PocRun, type PocRunOptions, runPoc } from "./poc-runner.ts";
 import {
   detectWorkspaceRoot,
@@ -86,11 +93,7 @@ import {
   scratchpad_write,
   setScratchpadRoot,
 } from "./scratchpad.ts";
-import {
-  STATIC_CYBER_WORKFLOW,
-  STATIC_CYBER_WORKFLOW_LITE,
-  STATIC_CYBER_WORKFLOW_OMP,
-} from "./workflow.ts";
+import { STATIC_RECON_WORKFLOW, STATIC_RECON_WORKFLOW_OMP } from "./workflow.ts";
 
 // ── Schemas ───────────────────────────────────────────────────────────
 
@@ -135,6 +138,12 @@ const CommonFields = {
       description: "Documented attempt to disprove the finding before confirmation",
     }),
   ),
+  invariant: Type.Optional(
+    Type.String({
+      description:
+        "The security invariant this finding violates — the rule broken (e.g. 'a user cannot read another user's orders'). Confirmation checks the invariant is actually violated, not just that a request returned 200.",
+    }),
+  ),
 };
 
 // ── Tool: CaseAdd ─────────────────────────────────────────────────────
@@ -226,7 +235,7 @@ const PromoteSchema = Type.Object(
     oob: Type.Optional(
       Type.Boolean({
         description:
-          "Reserved for source-separated out-of-band verification. Currently fails closed because a loopback listener reachable by the PoC cannot prove target causation.",
+          "Blind/OOB confirmation via the operator-run oracle (PI_OOB_ORACLE_URL). The harness provisions per-run callback tokens, injects PI_POC_CALLBACK_DOMAIN into the runs, and polls the oracle itself: promotion requires target-token interactions, ZERO control-token interactions, attested source separation (PI_OOB_SOURCE_SEPARATED=1), and self-source/missing-src_ip interactions are rejected. Without an oracle this fails closed.",
       }),
     ),
   },
@@ -365,7 +374,7 @@ const UnlinkSchema = Type.Object(
 
 // ── Tool: Scratchpad ─────────────────────────────────────────────────
 //
-// The scratchpad is the pipeline's crash-recoverable artifact store.
+// The scratchpad is a crash-recoverable working-notes store for a run.
 // The casefile owns state transitions; the scratchpad owns artifacts
 // (recon maps, trace outputs, verification logs). Resume re-reads
 // artifacts; it does not re-run completed phases (idempotent).
@@ -605,10 +614,8 @@ class CasefileDashboard {
 }
 
 // ── Context injection ─────────────────────────────────────────────────
-// Injected once per user prompt via before_agent_start (not every tool turn).
-// Skills are opt-in; this keeps bounty discipline always present even with an empty ledger.
-
-// workflow.ts contains the full text
+// The active case list is injected via before_agent_start (once per user
+// prompt, not every tool turn) so open cases stay visible in context.
 
 function sanitizeContextText(v?: string, max = 160): string | undefined {
   // biome-ignore lint/suspicious/noControlCharactersInRegex: strip C0 controls from untrusted case text
@@ -694,101 +701,30 @@ function buildCaseListContext(records: CaseRecord[]): string {
 
 /**
  * Detect the extension host. OMP is a fork of Pi: both load the same
- * `pi`-manifest extensions, but subagent dispatch differs (pi-subagents'
+ * `pi`-manifest extensions, but recon subagent dispatch differs (pi-subagents'
  * `subagent({workflowScript})` vs OMP's native `task`). The entry script path
- * carries the host package: `@oh-my-pi/pi-coding-agent/dist/cli.js` under OMP,
- * `@earendil-works/pi-coding-agent` under Pi.
+ * carries the host package.
  */
-export function detectHost(): "omp" | "pi" {
+function detectHost(): "omp" | "pi" {
   const argv = process.argv.join(" ");
   if (argv.includes("@oh-my-pi")) return "omp";
   return "pi";
 }
 
 /**
- * Builds the per-prompt injection. The cyber workflow is session-scope data —
- * it never changes — so the caller passes includeWorkflow=true exactly once
- * per session; re-injecting it on every prompt is pure token cost. The active
- * case list DOES change as cases are added, so it is refreshed every prompt.
- *
- * mode selects the workflow text: "lite" injects the single-agent workflow
- * (no subagent dispatch), "swarm" gets the full subagent pipeline,
- * rendered for the host's dispatch convention (pi-subagents vs OMP task).
+ * Per-prompt injection. The recon workflow is session-scope guidance — it never
+ * changes — so it is injected once (first prompt, includeWorkflow=true). The
+ * active case list DOES change as cases are added, so it refreshes every prompt.
+ * The workflow text is rendered for the host's dispatch convention.
  */
-function buildAgentInjection(
-  active: CaseRecord[],
-  includeWorkflow: boolean,
-  mode: XpMode = "swarm",
-): string {
+function buildAgentInjection(active: CaseRecord[], includeWorkflow: boolean): string {
   const caseList = buildCaseListContext(active);
   if (!includeWorkflow) return caseList;
-  const workflow =
-    mode === "lite"
-      ? STATIC_CYBER_WORKFLOW_LITE
-      : detectHost() === "omp"
-        ? STATIC_CYBER_WORKFLOW_OMP
-        : STATIC_CYBER_WORKFLOW;
+  const workflow = detectHost() === "omp" ? STATIC_RECON_WORKFLOW_OMP : STATIC_RECON_WORKFLOW;
   // Workflow FIRST for prominence, then case list as reference data.
   return caseList ? `${workflow}\n\n${caseList}` : workflow;
 }
 
-// ── XP (offensive / exploit) mode toggle ─────────────────────────────
-// Casefile historically injected the cyber workflow into every prompt.
-// For normal dev work that is just noise, so XP mode defaults OFF. Enable
-// swarm for the bounded multi-agent variant, or lite for the single-agent
-// attacker discipline. Toggle with /xp (off <-> swarm), or set explicitly with
-// /xp on|lite|swarm|off. "on" means the default enabled SWARM mode; use "lite"
-// for no subagent dispatch.
-// Override per-session with PI_XP_MODE.
-// Pure helpers exported for unit tests.
-
-export const XP_MODE_ENV = "PI_XP_MODE";
-export type XpMode = "swarm" | "off" | "lite";
-
-export function getXpModeStatePath(): string {
-  return join(dirname(getCasefilePath()), "xp-mode");
-}
-
-export function readXpMode(
-  envValue: string | undefined = process.env[XP_MODE_ENV],
-  statePath: string = getXpModeStatePath(),
-): XpMode {
-  const env = (envValue ?? "").trim().toLowerCase();
-  if (env === "swarm") return "swarm";
-  if (env === "on" || env === "1" || env === "true") return "swarm";
-  if (env === "lite") return "lite";
-  if (env === "off" || env === "0" || env === "false") return "off";
-  try {
-    if (existsSync(statePath)) {
-      const v = readFileSync(statePath, "utf8").trim().toLowerCase();
-      if (v === "swarm" || v === "on") return "swarm";
-      if (v === "lite") return "lite";
-      if (v === "off") return "off";
-    }
-  } catch {
-    // ignore and fall through to default
-  }
-  return "off";
-}
-
-export function writeXpMode(state: XpMode, statePath: string = getXpModeStatePath()): void {
-  try {
-    writeFileSync(statePath, state, "utf8");
-  } catch {
-    // best-effort; env var can still override at runtime
-  }
-}
-
-export function parseXpModeArg(args: string, current: XpMode): XpMode {
-  const arg = (args ?? "").trim().toLowerCase();
-  if (arg === "swarm") return "swarm";
-  if (arg === "on") return "swarm";
-  if (arg === "off") return "off";
-  if (arg === "lite") return "lite";
-  // Bare /xp is the low-ceremony path: toggle the default XP workflow on/off.
-  return current === "off" ? "swarm" : "off";
-}
-
 // ── Main extension ────────────────────────────────────────────────────
 
 export default function casefileExtension(pi: ExtensionAPI) {
@@ -845,6 +781,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
     promptGuidelines: [
       "Use CaseAdd for a new security lead. New cases start as status='hypothesis' or 'investigating' — promote later with CaseUpdate.",
       "disproveIf is REQUIRED on CaseAdd: name the falsification conditions (what would disprove this hypothesis). A hypothesis that can't say what kills it isn't a hypothesis yet.",
+      "Declare the invariant: the security rule the finding would violate (e.g. 'a user cannot read another user's orders'). Confirmation checks the invariant is actually broken, not just that a request succeeded — a reproduction without a violated invariant is a mechanism, not a vulnerability.",
       "Check the injected case list or CaseList/CaseSearch first. Do not add a duplicate for the same title/scope.",
       "CaseAdd rejects exact and NEAR-duplicates (same target + overlapping title, e.g. parallel-subagent re-phrasings). A near-duplicate result → continue the existing case ID via CaseUpdate, don't create a new one.",
       "confirmed/reported only via their gates: proof in poc + PromoteFinding for confirmed; CaseContext + report for reported.",
@@ -1169,8 +1106,9 @@ export default function casefileExtension(pi: ExtensionAPI) {
         "The PoC MUST write evidence.json to $PI_POC_EVIDENCE_DIR: { nonce (echo $PI_POC_NONCE), claim, verify: { method, url, expect: { status?, body_contains/body_regex } }, observations }. A non-empty body predicate is mandatory; status-only evidence is rejected. verify.url must belong to the case target.",
         "For reflection-capable requests, place {{PI_POC_CANARY}} exactly once in verify.url/body/header values and declare verify.canary={mode:'reflection',placeholder:'{{PI_POC_CANARY}}'}. The harness substitutes an unpredictable value only after the PoC exits and requires target-only reflection; the raw token is not persisted.",
         "control_path is optional and defaults to poc_path; if supplied, it must be the SAME script as poc_path. control_target must be pre-approved by the operator in PI_POC_CONTROL_TARGETS. The harness derives the control request from the target request, changes only its origin, and applies the same predicates to two conclusive responses.",
+        "oob=true unlocks blind/OOB classes (SSRF, blind XSS, XXE): the harness provisions per-run callback tokens via the operator's oracle (PI_OOB_ORACLE_URL), injects PI_POC_CALLBACK_DOMAIN into the runs, and polls the oracle itself — target-token interactions with ZERO control-token interactions are required. Promotion additionally requires attested source separation (PI_OOB_SOURCE_SEPARATED=1); without it the verification stays diagnostic.",
         "local:true requires PI_POC_ALLOW_NETWORK=1. Private/internal harness replay additionally requires PI_POC_ALLOW_PRIVATE_REPLAY=1. Neither silently falls back to a model verdict.",
-        "Blind/OOB classes are not promotable through the built-in loopback listener because the PoC can self-call it; obtain a direct-response or state oracle, otherwise keep the case investigating.",
+        "Blind/OOB classes fail closed unless the operator configured an OOB oracle; self-interactions (PI_OOB_SELF_IPS) are rejected and never counted as target hits.",
         "After the bundle is recorded, stay in the main agent: inspect the script/evidence, attempt disconfirmation, and call ConfirmFinding itself; that call performs a fresh harness-owned target/control replay. Never delegate validation/confirmation and never CaseUpdate status='confirmed' directly.",
       ],
       parameters: PromoteSchema,
@@ -1203,13 +1141,47 @@ export default function casefileExtension(pi: ExtensionAPI) {
             missingPocPath: true,
           });
         }
-        // Control-target preconditions apply only to the inter-host differential.
-        // Intra-target proves target-dependence with a same-host baseline request
-        // carried in the evidence, so it needs no control target or control script.
-        if (!isIntra) {
+        const caseTarget = current.target ?? "";
+        // ── OOB callback (Tier 1, opt-in for blind classes) ──
+        // The operator-run oracle owns the evidence channel; the harness owns
+        // the secret (per-run token, provisioned before the runs and injected
+        // as env — the value does not exist when the script was written).
+        // Without an oracle this stays fail-closed.
+        const oobRequested = params.oob === true;
+        // Intra-target + OOB is rejected up front: intra_target's
+        // discriminating variable is identity/parameter on the SAME host;
+        // mixing it with a callback differential would make precedence
+        // ambiguous. OOB is for inter-host/blind classes.
+        if (isIntra && oobRequested) {
+          return fail(
+            "mode:'intra_target' cannot be combined with oob:true — intra-target proof uses a same-host baseline request, not a callback channel. Use one or the other.",
+            { intraOobConflict: true },
+          );
+        }
+        let oobConfig: OobOracleConfig | undefined;
+        let targetCallback: ProvisionedCallback | undefined;
+        let controlCallback: ProvisionedCallback | undefined;
+        if (oobRequested) {
+          const oracle = readOobOracleConfig();
+          if (!oracle.config) {
+            return fail(`OOB CONFIRMATION UNAVAILABLE: ${oracle.error}`, {
+              oobOracleNotConfigured: true,
+            });
+          }
+          oobConfig = oracle.config;
+          // Provision both identities concurrently — each is an oracle round trip.
+          [targetCallback, controlCallback] = await Promise.all([
+            provisionCallback(oobConfig),
+            provisionCallback(oobConfig),
+          ]);
+        }
+        // OOB-only bundles (blind classes, no operator-approved control host)
+        // prove target-dependence via the token differential instead.
+        const oobOnly = oobRequested && !controlTarget;
+        if (!isIntra && !oobOnly) {
           if (!controlTarget) {
             return fail(
-              "control_target is REQUIRED for inter-host mode: a distinct baseline target that lacks the vulnerability. For access-control/logic bugs use mode='intra_target' with an evidence baseline instead.",
+              "control_target is REQUIRED for inter-host mode: a distinct baseline target that lacks the vulnerability. For access-control/logic bugs use mode='intra_target' with an evidence baseline instead; for blind/OOB classes pass oob=true (with or without a control target).",
               { missingControlTarget: true },
             );
           }
@@ -1226,7 +1198,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
             { networkNotAuthorized: true },
           );
         }
-        if (!isIntra) {
+        if (!isIntra && !oobOnly) {
           const controlAuthorization = controlTargetAuthorizationError(controlTarget);
           if (controlAuthorization) {
             return fail(
@@ -1247,7 +1219,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
             sameFileCheckFailed: true,
           });
         }
-        if (!isIntra) {
+        if (!isIntra && !oobOnly) {
           let controlHash: string | undefined;
           try {
             controlHash = createHash("sha256").update(readFileSync(controlPath)).digest("hex");
@@ -1265,24 +1237,22 @@ export default function casefileExtension(pi: ExtensionAPI) {
           }
         }
 
-        // ── OOB callback (Tier 1, opt-in for blind classes) ──
-        const oobRequested = params.oob === true;
-        if (oobRequested) {
-          return fail(
-            "OOB confirmation is fail-closed: the built-in loopback listener is reachable by the PoC and cannot prove the target caused a callback. A source-separated, operator-owned callback service is required before blind findings can be promoted.",
-            { oobSourceSeparationRequired: true },
-          );
-        }
+        // ── OOB callback tokens were provisioned above, before the runs ──
         const runOptions = (pocMode: string, target: string): PocRunOptions => ({
           network: params.local === true ? "host" : "none",
           local: params.local === true,
           env: {
             PI_POC_MODE: pocMode,
             PI_POC_TARGET: target,
+            ...(oobRequested && targetCallback && controlCallback
+              ? {
+                  PI_POC_CALLBACK_DOMAIN:
+                    pocMode === "control" ? controlCallback.domain : targetCallback.domain,
+                }
+              : {}),
           },
         });
 
-        const caseTarget = current.target ?? "";
         // Determinism: TWO target runs. Exit 0 is run integrity only; nonce-bound
         // body evidence plus the harness-owned differential replay (inter-host
         // control, or intra-target same-host baseline) form the machine gate.
@@ -1336,8 +1306,18 @@ export default function casefileExtension(pi: ExtensionAPI) {
           evidenceRun(run2, "poc", caseTarget),
         ];
 
+        // Reflection canary + OOB is rejected after run 1 (the canary is
+        // declared inside evidence.json): the canary path requires a harness
+        // response transcript, which OOB-only bundles never produce — the
+        // per-run callback token IS the causality signal there.
+        if (oobRequested && targetRuns.some((r) => r.evidence.verify.canary !== undefined)) {
+          return fail(
+            "verify.canary cannot be combined with oob:true — the per-run callback token already provides a harness-owned causality signal. Remove the {{PI_POC_CANARY}} placeholder and verify.canary from evidence.json, then re-promote.",
+            { canaryOobConflict: true },
+          );
+        }
         const allowPrivateReplay = process.env.PI_POC_ALLOW_PRIVATE_REPLAY === "1";
-        let harnessVerified: HarnessVerifyResult;
+        let harnessVerified: HarnessVerifyResult | undefined;
         let controlRun: PocEvidenceRun | undefined;
         if (isIntra) {
           // Intra-target: prove target-dependence with the evidence's same-host
@@ -1359,7 +1339,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
           harnessVerified = await replayIntraTarget(ev0, caseTarget, {
             allowPrivate: allowPrivateReplay,
           });
-        } else {
+        } else if (!oobOnly) {
           // Inter-host (Tier 2): the harness executes the SAME request template
           // against target and operator-approved control, applying the target's
           // predicates to both. DNS is pinned at connect time.
@@ -1375,6 +1355,20 @@ export default function casefileExtension(pi: ExtensionAPI) {
             { allowPrivate: allowPrivateReplay },
           );
         }
+        // OOB differential: poll the oracle for both run tokens. The ledger's
+        // assertMachineConfirmation consumes this BEFORE the response-diff
+        // requirement — blind classes pass via this path when the oracle saw
+        // the target token and NOT the control token under attested source
+        // separation.
+        let callbackVerified: OobVerification | undefined;
+        if (oobConfig && targetCallback && controlCallback) {
+          callbackVerified = (
+            await verifyOobDifferential({
+              targetToken: targetCallback.token,
+              controlToken: controlCallback.token,
+            })
+          ).verification;
+        }
         const bundle: PendingConfirmation = {
           caseId,
           ranAt: new Date().toISOString(),
@@ -1383,7 +1377,16 @@ export default function casefileExtension(pi: ExtensionAPI) {
           mode,
           targetRuns,
           harnessVerified,
-          ...(isIntra ? {} : { controlPath, controlTarget, controlRun }),
+          ...(callbackVerified && targetCallback && controlCallback
+            ? {
+                callbackVerified,
+                oobTokens: {
+                  targetToken: targetCallback.token,
+                  controlToken: controlCallback.token,
+                },
+              }
+            : {}),
+          ...(!(isIntra || oobOnly) ? { controlPath, controlTarget, controlRun } : {}),
         };
 
         let record: CaseRecord;
@@ -1404,7 +1407,11 @@ export default function casefileExtension(pi: ExtensionAPI) {
                 `Mode: ${mode}. ${isIntra ? "Target runs: 2, same-host baseline differential" : "Target runs: 2, Control run: 1"} — all with validated nonce-bound evidence.json.\n` +
                 `Evidence sha256: ${targetRuns[0].evidenceSha256}\n` +
                 `PoC script sha256 (at run time): ${pocHash}\n` +
-                `Harness verify replay: ${harnessVerified.attempted ? (harnessVerified.pass ? `PASS (status ${harnessVerified.status})` : `FAILED — ${harnessVerified.note}`) : harnessVerified.note}\n` +
+                `Harness verify replay: ${harnessVerified?.attempted ? (harnessVerified.pass ? `PASS (status ${harnessVerified.status})` : `FAILED — ${harnessVerified.note}`) : (harnessVerified?.note ?? "not run")}
+` +
+                (callbackVerified
+                  ? `OOB oracle: target-token hits ${callbackVerified.targetHits}, control-token hits ${callbackVerified.controlHits}, source-separated: ${String(callbackVerified.sourceSeparated)} — ${callbackVerified.note}\n`
+                  : "") +
                 `\nMAIN-AGENT REVIEW REQUIRED (do not delegate): inspect case ${caseId}, PoC ${pocPath}, ${isIntra ? "same-host baseline" : `control ${controlTarget}`}, evidence ${targetRuns[0].evidenceSha256}, and PoC hash ${pocHash}. Hunt for a trivial predicate or fabricated differential and perform a concrete disconfirmation attempt, then call ConfirmFinding yourself. A CONFIRMED call performs and stores a fresh harness-owned ${isIntra ? "attack/baseline" : "target/control"} replay; NOT_CONFIRMED keeps the case investigating.`,
             },
           ],
@@ -1454,15 +1461,18 @@ export default function casefileExtension(pi: ExtensionAPI) {
       name: "ConfirmFinding",
       label: "Main-Agent Confirmation",
       description:
-        "Phase 2 of confirmation, reserved for the main/coordinator agent: commit or refuse promotion after personally reviewing the machine bundle. On CONFIRMED, this tool performs a fresh harness-owned target/control replay; the verdict requires a target-only differential, a concrete re_execution_note and disconfirmation_attempt, a canary assessment, and the still-valid PromoteFinding bundle. The machine transcript is evidence, not the semantic vulnerability verdict. Worker/subagent processes are rejected. NOT_CONFIRMED records the review and keeps the case investigating.",
-      promptSnippet: "Main agent: independently review and commit or refuse PoC confirmation",
+        "Phase 2 of confirmation, reserved for the main/coordinator agent: commit or refuse promotion after independently re-testing the finding. On CONFIRMED, this tool performs a fresh harness-owned target/control replay; the verdict requires a target-only differential, a concrete re_execution_note and disconfirmation_attempt, a canary assessment, and the still-valid PromoteFinding bundle. The machine transcript is evidence, not the semantic vulnerability verdict. Worker/subagent processes are rejected. Three verdicts: CONFIRMED (you reproduced real impact), NOT_CONFIRMED (you POSITIVELY disproved it), INCONCLUSIVE (you could neither reproduce nor disprove — the case is preserved for manual review, never dropped).",
+      promptSnippet: "Main agent: independently re-test, then commit or refuse PoC confirmation",
       promptGuidelines: [
         "Run only in the main/coordinator agent after PromoteFinding returns. Do not dispatch a worker to decide or author this verdict.",
-        "Personally inspect the PoC and preserved evidence and try a concrete disconfirmation before deciding. ConfirmFinding itself re-sends the immutable verify request against target and operator-approved control so phase 2 has a harness-owned transcript.",
-        "CONFIRMED requires differential: 'target_only', re_execution_note, and disconfirmation_attempt (the main agent's failed disproof). A verdict missing any of these is rejected.",
-        "Set canary_assessment='verified' when the immutable request declared a canary; otherwise set not_applicable and explain why a reflection canary is not meaningful for this exploit class.",
-        "NOT_CONFIRMED is final for that attempt — the case stays investigating with the main agent's reasoning recorded. A fresh PromoteFinding run is required for another attempt.",
-        "Never CaseUpdate status='confirmed' directly — it is rejected. Always use PromoteFinding + ConfirmFinding.",
+        "Verify with DISBELIEF: assume the finding is a false positive until your OWN re-test proves otherwise. Reproduce the exact observable yourself from the primary evidence (not the hunter's narrative), with a negative/baseline control — a difference you cannot tie to the control is not proof. ConfirmFinding itself re-sends the immutable verify request against target and operator-approved control so phase 2 has a harness-owned transcript.",
+        "Provenance: the proof must exercise THIS finding's own mechanism. Evidence obtained through a DIFFERENT bug (e.g. 'SQLi' proven by dumping the DB via an RCE) does not confirm it — that is INCONCLUSIVE at best.",
+        "Kill the cheapest benign explanation: is this the technology's intended behavior? Did the attacker supply the 'secret' themselves (circular)? Is the claimed C/I/A impact actually demonstrated?",
+        "Want a second pair of eyes? Dispatch a read-only skeptic subagent to re-test — it CANNOT confirm (only the main agent commits). You review its verdict and commit it here.",
+        "CONFIRMED requires differential: 'target_only', re_execution_note, and disconfirmation_attempt (your failed disproof). A verdict missing any of these is rejected. Set canary_assessment='verified' when the immutable request declared a canary; otherwise not_applicable with a reason.",
+        "NOT_CONFIRMED means you POSITIVELY disproved it (by-design, circular, mislabeled, no impact). Never mark NOT_CONFIRMED merely because you could not reproduce it.",
+        "INCONCLUSIVE when you could neither reproduce nor disprove (needs auth, a second account, specific state, timing, or a blind/stored trigger you cannot observe). The case stays investigating and is preserved for manual review — dropping a real finding is worse than keeping an unproven one.",
+        "Every verdict consumes the attempt: a fresh PromoteFinding run is required to try again. Never CaseUpdate status='confirmed' directly — always PromoteFinding + ConfirmFinding.",
       ],
       parameters: ConfirmSchema,
 
@@ -1493,6 +1503,46 @@ export default function casefileExtension(pi: ExtensionAPI) {
             replay = await replayIntraTarget(bundle.targetRuns[0].evidence, caseTargetForReplay, {
               allowPrivate,
             });
+          } else if (bundle.callbackVerified?.attempted && bundle.oobTokens) {
+            // OOB differential: fresh harness-owned re-poll of BOTH run tokens.
+            // Re-polling at confirm time catches interactions that landed after
+            // phase 1 (e.g. a delayed control-token hit) — the verdict is bound
+            // to this fresh observation, not the stored one.
+            const { verification } = await verifyOobDifferential({
+              targetToken: bundle.oobTokens.targetToken,
+              controlToken: bundle.oobTokens.controlToken,
+            });
+            const oobPass =
+              verification.targetHits > 0 &&
+              verification.controlHits === 0 &&
+              verification.sourceSeparated === true;
+            replay = {
+              attempted: true,
+              pass: oobPass,
+              target: {
+                attempted: true,
+                matched: verification.targetHits > 0,
+                url: bundle.targetRuns[0].evidence.verify.url,
+                note: verification.note,
+              },
+              control: {
+                attempted: true,
+                matched: verification.controlHits > 0,
+                url: bundle.targetRuns[0].evidence.verify.url,
+                note: `${verification.controlHits} control-token interaction(s)`,
+              },
+              differential:
+                verification.targetHits > 0
+                  ? verification.controlHits === 0
+                    ? "target_only"
+                    : "both"
+                  : "neither",
+              note: `harness OOB re-poll: ${verification.note}`,
+            };
+          } else if (bundle.callbackVerified?.attempted) {
+            throw new Error(
+              "OOB bundle lacks its provisioned tokens (pre-token-storage ledger) — re-run PromoteFinding for a fresh bundle",
+            );
           } else {
             if (!bundle.controlTarget) {
               throw new Error("inter-host confirmation requires a control target");
@@ -1525,7 +1575,10 @@ export default function casefileExtension(pi: ExtensionAPI) {
               text: promoted
                 ? `Main agent CONFIRMED. Case promoted:
 ${formatCaseDetail(record)}`
-                : `Main agent NOT_CONFIRMED — case stays investigating (attempt recorded):
+                : parsedVerdict.verdict.verdict === "INCONCLUSIVE"
+                  ? `Main agent INCONCLUSIVE — case stays investigating, preserved for manual review (not disproved):
+${formatCaseDetail(record)}`
+                  : `Main agent NOT_CONFIRMED — case stays investigating (attempt recorded):
 ${formatCaseDetail(record)}`,
             },
           ],
@@ -1763,67 +1816,6 @@ ${formatCaseDetail(record)}`,
     },
   });
 
-  // ── Tool: ChainSuggest ──
-
-  const ChainSuggestSchema = Type.Object(
-    {
-      case_id: Type.Optional(
-        Type.String({
-          description:
-            "Optional: scope suggestions to this case and its linked cases. Omit to scan all non-terminal cases.",
-        }),
-      ),
-    },
-    { additionalProperties: false },
-  );
-
-  registerCaseTool({
-    name: "ChainSuggest",
-    label: "Suggest Exploit Chains",
-    description:
-      "Scan non-terminal cases for exploitable chains (credential+endpoint→ATO, open-redirect+OAuth→token theft, XSS+state-changing→CSRF bypass, IDOR+user-data→mass leak, SSTI→RCE, race+payment→financial, info-disclosure+SSRF). Returns ranked candidates with confidence and a suggested link kind — the agent decides whether to CaseLink them or open an escalation case. Catches chain combinations the model may have missed.",
-    promptSnippet: "Find missed exploit-chain combinations",
-    promptGuidelines: [
-      "Run ChainSuggest before concluding an engagement — low-severity findings that chain into high-impact (ATO, token theft, mass leak) are the ones triage cares about.",
-      "A suggestion is a HYPOTHESIS to verify, not a finding: test the chained behavior on the live target before linking or promoting anything.",
-      "Chain a suggested pair with CaseLink (suggested kind) or open a new escalation case with status=hypothesis.",
-    ],
-    parameters: ChainSuggestSchema,
-
-    async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const suggestions = await suggestChainsAsync(
-        (params.case_id as string | undefined) ?? undefined,
-      );
-      const lines: string[] = [
-        suggestions.length
-          ? `${suggestions.length} chain candidate(s):`
-          : "No chain candidates found across non-terminal cases.",
-      ];
-      for (const s of suggestions) {
-        const pair = s.targetId
-          ? `${s.sourceId} (${s.sourceTitle}) + ${s.targetId} (${s.targetTitle ?? ""})`
-          : `${s.sourceId} (${s.sourceTitle})`;
-        lines.push(
-          `\n[${s.pattern}] conf ${s.confidence}% — ${pair}\n  ${s.rationale}${s.suggestedKind ? `\n  suggested link kind: ${s.suggestedKind}` : ""}`,
-        );
-      }
-      return {
-        content: [{ type: "text", text: lines.join("\n") }],
-        details: { suggestions },
-      };
-    },
-
-    renderCall(args, theme) {
-      return callLine(theme, "ChainSuggest", (args.case_id as string) ?? "all");
-    },
-
-    renderResult(result, _opts, theme) {
-      const details = result.details as { suggestions?: { length: number } } | undefined;
-      const n = details?.suggestions?.length ?? 0;
-      return new Text(theme.fg(n ? "accent" : "dim", `${n} chain candidate(s)`), 0, 0);
-    },
-  });
-
   // ── Tool: CaseContext ──
 
   registerCaseTool({
@@ -1839,7 +1831,7 @@ ${formatCaseDetail(record)}`,
     parameters: IdSchema,
 
     async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const { path, contextPath, record } = await writeCaseContextAsync(params.id as string);
+      const { path, contextPath, record } = writeCaseContext(params.id as string);
       return {
         content: [
           {
@@ -1865,97 +1857,6 @@ ${formatCaseDetail(record)}`,
     },
   });
 
-  // ── Command: /xp (toggle offensive XP mode) ──
-
-  pi.registerCommand("xp", {
-    description:
-      "Toggle casefile XP (offensive) mode. Bare /xp and /xp on select SWARM, the bounded multi-agent workflow. LITE keeps XP single-agent. OFF (default) keeps context quiet for normal dev work. Usage: /xp [on|lite|swarm|off]",
-    handler: async (args, ctx) => {
-      const next = parseXpModeArg(args ?? "", readXpMode());
-      writeXpMode(next);
-      // Re-enabling after a mid-session /xp off must re-inject the workflow
-      // on the next prompt — otherwise workflowInjected (module-level, set on
-      // first enable) stays true and the workflow never comes back until the
-      // process restarts.
-      if (next !== "off") workflowInjected = false;
-      ctx.ui.notify(
-        `Casefile XP mode: ${next.toUpperCase()} (takes effect on the next prompt)`,
-        next === "off" ? "warning" : "info",
-      );
-    },
-  });
-
-  // ── Tool: PipelineSubmit ──
-
-  registerCaseTool({
-    name: "PipelineSubmit",
-    label: "Submit Stage Output",
-    description:
-      "Submit a pipeline stage's output (hunt, trace, skeptic, validate, chain, report) through the validation gate. Validates required fields against the stage spec (mirrors schemas/*.json), applies the deterministic pre-filter (test-path and file-existence filters on hunt findings, trivial dedup by file+class+line), and counts repair attempts (max 2, then rejected). A stage cannot advance on an invalid output — submit fixed output until accepted.",
-    promptSnippet: "Validate and submit a pipeline stage's output",
-    promptGuidelines: [
-      "Every delegated stage output and every main-agent VALIDATE/REPORT output must go through PipelineSubmit before the next stage starts — do not eyeball schemas.",
-      "verdict repair → fix the listed fields and re-submit the same output; budget is 2 attempts per finding, then rejected.",
-      "Skeptic: unparseable/schema-invalid = no verdict (repair/re-dispatch); only schema-valid DISPROVEN kills, and schema-valid UNDETERMINED blocks validation.",
-      "Tracer crash/invalid output = no trace verdict; repair or re-dispatch.",
-      'Only schema-valid trace_result: "UNREACHABLE" blocks advancement as a proven unreachable path; schema-valid UNDETERMINED blocks validation until resolved.',
-      "Test-path findings and hallucinated files are rejected by the pre-filter, not repairable — the finding itself is noise.",
-    ],
-    parameters: Type.Object(
-      {
-        run_id: Type.String({
-          description: "Pipeline run identifier (same as the scratchpad run_id)",
-        }),
-        stage: Type.String({
-          enum: [...SUBMIT_STAGES],
-          description: "Pipeline stage: hunt | trace | skeptic | validate | chain | report",
-        }),
-        output: Type.Union([Type.String(), Type.Object({}, { additionalProperties: true })], {
-          description: "The stage output as a JSON object or JSON string (code fences tolerated)",
-        }),
-      },
-      { additionalProperties: false },
-    ),
-
-    async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const result = pipeline_submit(
-        params.run_id as string,
-        params.stage as SubmitStage,
-        params.output,
-      );
-      const statusLine =
-        result.verdict === "accepted"
-          ? `ACCEPTED (${params.stage}) — artifact: ${result.artifact}`
-          : result.verdict === "repair"
-            ? `REPAIR (attempt ${result.repair_attempt}/2) — fix these and re-submit:\n  - ${result.errors.join("\n  - ")}`
-            : `REJECTED — ${result.errors.join("\n")}`;
-      if (result.verdict !== "accepted") throw new Error(statusLine);
-      return {
-        content: [{ type: "text", text: statusLine }],
-        details: result as unknown as Record<string, unknown>,
-      };
-    },
-
-    renderCall(args, theme) {
-      return callLine(theme, "PipelineSubmit", `${args.stage ?? ""}`);
-    },
-
-    renderResult(result, _opts, theme) {
-      const details = result.details as { verdict?: string; repair_attempt?: number } | undefined;
-      if (details?.verdict === "accepted") {
-        return new Text(theme.fg("success", "✓ PipelineSubmit accepted"), 0, 0);
-      }
-      if (details?.verdict === "repair") {
-        return new Text(
-          theme.fg("warning", `↷ PipelineSubmit repair ${details.repair_attempt}/2`),
-          0,
-          0,
-        );
-      }
-      return new Text(theme.fg("error", "✗ PipelineSubmit rejected"), 0, 0);
-    },
-  });
-
   // ── Tool: ScratchpadInit ──
 
   registerCaseTool({
@@ -2319,22 +2220,19 @@ ${formatCaseDetail(record)}`,
     }
   });
 
-  // ── Event: Inject cyber workflow into system prompt ──
-  // XP (offensive) mode is OFF by default so normal dev work stays quiet.
-  // When enabled, the cyber workflow is injected ONCE per session (first
-  // prompt); the active case list refreshes every prompt because it changes
-  // as cases are added. Injecting into event.systemPrompt (not as a
-  // conversation message) avoids session bloat from repeated message entries.
+  // ── Event: Inject the recon workflow + active-case list into the prompt ──
+  // The recon workflow is injected ONCE per session (first prompt); the active
+  // case list refreshes every prompt because it changes as cases are added.
+  // Injecting into event.systemPrompt (not as a conversation message) avoids
+  // session bloat from repeated message entries.
   let workflowInjected = false;
 
   pi.on("before_agent_start", async (event) => {
-    const mode = readXpMode();
-    if (mode === "off") return;
     // Skip subagent child processes: pi-subagents runs each child in its own
     // pi process (PI_SUBAGENT_CHILD=1) with this extension loaded. Injecting
     // the workflow + entire active-case ledger into every child dispatch is a
-    // token multiplier (N subagents × workflow + growing case list per turn) —
-    // workers get what they need via their task and tool guidelines.
+    // token multiplier (N children × workflow + growing case list per turn) —
+    // recon workers get what they need via their task, not the coordinator's.
     if (isSubagentProcess()) return;
 
     const includeWorkflow = !workflowInjected;
@@ -2343,15 +2241,13 @@ ${formatCaseDetail(record)}`,
     try {
       active = readActiveCases();
     } catch {
-      // No database yet — still inject workflow.
+      // No database yet — still inject the workflow.
     }
 
-    const injection = buildAgentInjection(active, includeWorkflow, mode);
+    const injection = buildAgentInjection(active, includeWorkflow);
     if (!injection) return; // workflow already injected, no active cases
     workflowInjected = true;
 
-    // Inject workflow FIRST (before skills) so the attacker mindset is
-    // prominent, not buried at the end of a long system prompt.
     return {
       systemPrompt: `${injection}\n\n${event.systemPrompt ?? ""}`,
     };