@xaccefy/pi-casefile 0.9.4 → 0.10.1

package/src/index.ts

@@ -1,14 +1,13 @@
 /**
  * Casefile — offensive security case tracker for Pi.
  *
- * Tools: CaseAdd, CaseUpdate, PromoteFinding, ConfirmFinding, EvidenceAdd, CoverageAdd, CoverageReport, ChainSuggest, CaseGet, CaseList, CaseSearch, CaseLink, CaseUnlink, CaseContext, PipelineSubmit, ScratchpadInit, ScratchpadResume, ScratchpadCheckpoint, ScratchpadWrite, ScratchpadRead, ScratchpadPhaseDone, ScratchpadClear
+ * Tools: CaseAdd, CaseUpdate, PromoteFinding, ConfirmFinding, EvidenceAdd, CoverageAdd, CaseGet, CaseList, CaseSearch, CaseLink, CaseUnlink, CaseContext, ScratchpadWrite, ScratchpadRead, ScratchpadClear
  * Command: /casefile — interactive dashboard
- * Event: before_agent_start — injects cyber workflow once per session, refreshes the active case list per prompt
+ * Event: before_agent_start — injects the recon workflow once per session, refreshes the active case list per prompt
  */
 
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { readFileSync } from "node:fs";
 import type { ExtensionAPI, ToolDefinition } from "@earendil-works/pi-coding-agent";
 import { matchesKey, Text, truncateToWidth } from "@earendil-works/pi-tui";
 import { type TSchema, Type } from "typebox";
@@ -16,8 +15,10 @@ import {
   CANARY_ASSESSMENT_VALUES,
   CONFIRM_DIFFERENTIAL_VALUES,
   CONFIRM_VERDICT_VALUES,
+  PANEL_VERDICT_VALUES,
   SEVERITY_MATCH_VALUES,
   validateMainAgentVerdict,
+  validatePanelVotes,
 } from "./evidence.ts";
 import {
   controlTargetAuthorizationError,
@@ -43,7 +44,6 @@ import {
   type CoverageItem,
   type CoverageScope,
   countCases,
-  coverageSummary,
   EVIDENCE_ROLE_VALUES,
   type EvidenceItem,
   type EvidenceRole,
@@ -55,6 +55,7 @@ import {
   LINK_KIND_VALUES,
   linkCasesResult,
   type MainAgentVerification,
+  type OobVerification,
   type PendingConfirmation,
   type PocEvidenceRun,
   PRIORITY_VALUES,
@@ -68,29 +69,26 @@ import {
   storePendingConfirmation,
   unlinkCasesResult,
   updateCaseResult,
+  writeCaseContext,
 } from "./ledger.ts";
-import { suggestChainsAsync, writeCaseContextAsync } from "./ledger-worker.ts";
-import { pipeline_submit, SUBMIT_STAGES, type SubmitStage } from "./pipeline-submit.ts";
+import {
+  type OobOracleConfig,
+  type ProvisionedCallback,
+  provisionCallback,
+  readOobOracleConfig,
+  verifyOobDifferential,
+} from "./oob-oracle.ts";
 import { type PocRun, type PocRunOptions, runPoc } from "./poc-runner.ts";
 import {
   detectWorkspaceRoot,
   SCRATCHPAD_PHASES,
   type ScratchpadPhase,
-  type ScratchpadResume,
-  scratchpad_checkpoint,
   scratchpad_clear,
-  scratchpad_init,
-  scratchpad_phase_done,
   scratchpad_read,
-  scratchpad_resume,
   scratchpad_write,
   setScratchpadRoot,
 } from "./scratchpad.ts";
-import {
-  STATIC_CYBER_WORKFLOW,
-  STATIC_CYBER_WORKFLOW_LITE,
-  STATIC_CYBER_WORKFLOW_OMP,
-} from "./workflow.ts";
+import { STATIC_RECON_WORKFLOW, STATIC_RECON_WORKFLOW_OMP } from "./workflow.ts";
 
 // ── Schemas ───────────────────────────────────────────────────────────
 
@@ -135,6 +133,27 @@ const CommonFields = {
       description: "Documented attempt to disprove the finding before confirmation",
     }),
   ),
+  invariant: Type.Optional(
+    Type.String({
+      description:
+        "The security invariant this finding violates — the rule broken (e.g. 'a user cannot read another user's orders'). Confirmation checks the invariant is actually violated, not just that a request returned 200.",
+    }),
+  ),
+  retry_policy: Type.Optional(
+    Type.Object(
+      {
+        max_attempts: Type.Number({
+          description: "Max attempts a phase may take for this case (integer 1–10)",
+        }),
+        fallback_models: Type.Optional(
+          Type.Array(Type.String(), {
+            description: "Fallback model identifiers to try when the primary model fails (≤8)",
+          }),
+        ),
+      },
+      { additionalProperties: false },
+    ),
+  ),
 };
 
 // ── Tool: CaseAdd ─────────────────────────────────────────────────────
@@ -181,6 +200,43 @@ const EvidenceAddSchema = Type.Object(
   { additionalProperties: false },
 );
 
+// ── Tool: CoverageAdd ─────────────────────────────────────────────────
+
+const CoverageAddSchema = Type.Object(
+  {
+    case_id: Type.String({
+      description: "Case ID (the finding case or target's main case) to record coverage under",
+    }),
+    asset: Type.String({
+      description:
+        "The asset tested — copy it verbatim from the case target where shown. For scope=wide use the deployment-wide identifier.",
+    }),
+    class: Type.String({
+      description:
+        "The attack class tested (e.g. sql-injection, xss, idor, ssti, ssrf, auth-bypass, ...).",
+    }),
+    // Provider-safe string enum (per the header rule): Type.Union(Type.Literal)
+    // serializes as anyOf/const, which some providers drop — scope would
+    // arrive undefined and every explicit 'wide' verdict would silently
+    // persist as 'local', under-reporting tested classes.
+    scope: Type.String({
+      enum: [...COVERAGE_SCOPE_VALUES],
+      description:
+        "'wide' if the verdict applies to the whole deployment/account/host (recorded ONCE, applies to every asset of the deployment — do NOT re-test it per asset); 'local' if specific to this one asset.",
+    }),
+    note: Type.String({
+      description: "Short note: techniques tried · result · key gap.",
+    }),
+    evidence_item_id: Type.Optional(
+      Type.String({
+        description:
+          "Optional artifact-backed evidence item (EvidenceAdd, on this case) backing the tested verdict. Cells without one render as unbacked.",
+      }),
+    ),
+  },
+  { additionalProperties: false },
+);
+
 // ── Tool: PromoteFinding (phase 1) / ConfirmFinding (phase 2) ──────────
 //
 // Confirmation is TWO-PHASE and main-agent-owned: PromoteFinding runs the PoC
@@ -226,9 +282,26 @@ const PromoteSchema = Type.Object(
     oob: Type.Optional(
       Type.Boolean({
         description:
-          "Reserved for source-separated out-of-band verification. Currently fails closed because a loopback listener reachable by the PoC cannot prove target causation.",
+          "Blind/OOB confirmation via the operator-run oracle (PI_OOB_ORACLE_URL). The harness provisions per-run callback tokens, injects PI_POC_CALLBACK_DOMAIN into the runs, and polls the oracle itself: promotion requires target-token interactions, ZERO control-token interactions, attested source separation (PI_OOB_SOURCE_SEPARATED=1), and self-source/missing-src_ip interactions are rejected. Without an oracle this fails closed.",
       }),
     ),
+    panel_votes: Type.Optional(
+      Type.Array(
+        Type.Object(
+          {
+            verdict: Type.String({ enum: [...PANEL_VERDICT_VALUES] }),
+            rationale: Type.String({ description: "Why this voter reached its verdict" }),
+            model: Type.String({ description: "Which model voted" }),
+            at: Type.Optional(Type.String({ description: "Vote timestamp (ISO)" })),
+          },
+          { additionalProperties: false },
+        ),
+        {
+          description:
+            "Optional pre-gate panel votes (≤5). CONFIRMED later requires a 2/3 exploit quorum or an explicit override note on the verdict; votes never commit anything.",
+        },
+      ),
+    ),
   },
   { additionalProperties: false },
 );
@@ -280,6 +353,12 @@ const ConfirmSchema = Type.Object(
               "Why a causal reflection canary is not meaningful for this exploit class. Required when canary_assessment=not_applicable.",
           }),
         ),
+        panel_override_note: Type.Optional(
+          Type.String({
+            description:
+              "Why CONFIRMED proceeds without a 2/3 exploit panel quorum (panel skipped, unavailable, or documented disagreement). Required for CONFIRMED whenever quorum was not reached.",
+          }),
+        ),
         model: Type.Optional(
           Type.String({ description: "Which model judged (recorded for the accuracy ledger)" }),
         ),
@@ -365,7 +444,7 @@ const UnlinkSchema = Type.Object(
 
 // ── Tool: Scratchpad ─────────────────────────────────────────────────
 //
-// The scratchpad is the pipeline's crash-recoverable artifact store.
+// The scratchpad is a crash-recoverable working-notes store for a run.
 // The casefile owns state transitions; the scratchpad owns artifacts
 // (recon maps, trace outputs, verification logs). Resume re-reads
 // artifacts; it does not re-run completed phases (idempotent).
@@ -376,7 +455,7 @@ const ScratchpadPhaseSchema = Type.String({
     "Pipeline phase: recon | hunt | trace | skeptic | validate | chain | patch | report (legacy gapfil is accepted for older runs)",
 });
 
-/** run_id-only schema, shared by Scratchpad Init / Resume / Clear. */
+/** run_id-only schema, shared by Scratchpad tools. */
 const RunIdSchema = Type.Object(
   {
     run_id: Type.String({ description: "Pipeline run identifier" }),
@@ -384,20 +463,6 @@ const RunIdSchema = Type.Object(
   { additionalProperties: false },
 );
 
-const ScratchpadCheckpointSchema = Type.Object(
-  {
-    run_id: Type.String({ description: "Run identifier" }),
-    phase: ScratchpadPhaseSchema,
-    ids: Type.Optional(
-      Type.Array(Type.String(), {
-        description: "Key IDs produced by this phase (case IDs, finding IDs)",
-      }),
-    ),
-    summary: Type.Optional(Type.String({ description: "One-line summary of phase completion" })),
-  },
-  { additionalProperties: false },
-);
-
 const ScratchpadWriteSchema = Type.Object(
   {
     run_id: Type.String({ description: "Run identifier" }),
@@ -419,14 +484,6 @@ const ScratchpadReadSchema = Type.Object(
   { additionalProperties: false },
 );
 
-const ScratchpadPhaseDoneSchema = Type.Object(
-  {
-    run_id: Type.String({ description: "Run identifier" }),
-    phase: ScratchpadPhaseSchema,
-  },
-  { additionalProperties: false },
-);
-
 interface Theme {
   fg(color: string, text: string): string;
   bold(text: string): string;
@@ -605,10 +662,8 @@ class CasefileDashboard {
 }
 
 // ── Context injection ─────────────────────────────────────────────────
-// Injected once per user prompt via before_agent_start (not every tool turn).
-// Skills are opt-in; this keeps bounty discipline always present even with an empty ledger.
-
-// workflow.ts contains the full text
+// The active case list is injected via before_agent_start (once per user
+// prompt, not every tool turn) so open cases stay visible in context.
 
 function sanitizeContextText(v?: string, max = 160): string | undefined {
   // biome-ignore lint/suspicious/noControlCharactersInRegex: strip C0 controls from untrusted case text
@@ -694,101 +749,30 @@ function buildCaseListContext(records: CaseRecord[]): string {
 
 /**
  * Detect the extension host. OMP is a fork of Pi: both load the same
- * `pi`-manifest extensions, but subagent dispatch differs (pi-subagents'
+ * `pi`-manifest extensions, but recon subagent dispatch differs (pi-subagents'
  * `subagent({workflowScript})` vs OMP's native `task`). The entry script path
- * carries the host package: `@oh-my-pi/pi-coding-agent/dist/cli.js` under OMP,
- * `@earendil-works/pi-coding-agent` under Pi.
+ * carries the host package.
  */
-export function detectHost(): "omp" | "pi" {
+function detectHost(): "omp" | "pi" {
   const argv = process.argv.join(" ");
   if (argv.includes("@oh-my-pi")) return "omp";
   return "pi";
 }
 
 /**
- * Builds the per-prompt injection. The cyber workflow is session-scope data —
- * it never changes — so the caller passes includeWorkflow=true exactly once
- * per session; re-injecting it on every prompt is pure token cost. The active
- * case list DOES change as cases are added, so it is refreshed every prompt.
- *
- * mode selects the workflow text: "lite" injects the single-agent workflow
- * (no subagent dispatch), "swarm" gets the full subagent pipeline,
- * rendered for the host's dispatch convention (pi-subagents vs OMP task).
+ * Per-prompt injection. The recon workflow is session-scope guidance — it never
+ * changes — so it is injected once (first prompt, includeWorkflow=true). The
+ * active case list DOES change as cases are added, so it refreshes every prompt.
+ * The workflow text is rendered for the host's dispatch convention.
  */
-function buildAgentInjection(
-  active: CaseRecord[],
-  includeWorkflow: boolean,
-  mode: XpMode = "swarm",
-): string {
+function buildAgentInjection(active: CaseRecord[], includeWorkflow: boolean): string {
   const caseList = buildCaseListContext(active);
   if (!includeWorkflow) return caseList;
-  const workflow =
-    mode === "lite"
-      ? STATIC_CYBER_WORKFLOW_LITE
-      : detectHost() === "omp"
-        ? STATIC_CYBER_WORKFLOW_OMP
-        : STATIC_CYBER_WORKFLOW;
+  const workflow = detectHost() === "omp" ? STATIC_RECON_WORKFLOW_OMP : STATIC_RECON_WORKFLOW;
   // Workflow FIRST for prominence, then case list as reference data.
   return caseList ? `${workflow}\n\n${caseList}` : workflow;
 }
 
-// ── XP (offensive / exploit) mode toggle ─────────────────────────────
-// Casefile historically injected the cyber workflow into every prompt.
-// For normal dev work that is just noise, so XP mode defaults OFF. Enable
-// swarm for the bounded multi-agent variant, or lite for the single-agent
-// attacker discipline. Toggle with /xp (off <-> swarm), or set explicitly with
-// /xp on|lite|swarm|off. "on" means the default enabled SWARM mode; use "lite"
-// for no subagent dispatch.
-// Override per-session with PI_XP_MODE.
-// Pure helpers exported for unit tests.
-
-export const XP_MODE_ENV = "PI_XP_MODE";
-export type XpMode = "swarm" | "off" | "lite";
-
-export function getXpModeStatePath(): string {
-  return join(dirname(getCasefilePath()), "xp-mode");
-}
-
-export function readXpMode(
-  envValue: string | undefined = process.env[XP_MODE_ENV],
-  statePath: string = getXpModeStatePath(),
-): XpMode {
-  const env = (envValue ?? "").trim().toLowerCase();
-  if (env === "swarm") return "swarm";
-  if (env === "on" || env === "1" || env === "true") return "swarm";
-  if (env === "lite") return "lite";
-  if (env === "off" || env === "0" || env === "false") return "off";
-  try {
-    if (existsSync(statePath)) {
-      const v = readFileSync(statePath, "utf8").trim().toLowerCase();
-      if (v === "swarm" || v === "on") return "swarm";
-      if (v === "lite") return "lite";
-      if (v === "off") return "off";
-    }
-  } catch {
-    // ignore and fall through to default
-  }
-  return "off";
-}
-
-export function writeXpMode(state: XpMode, statePath: string = getXpModeStatePath()): void {
-  try {
-    writeFileSync(statePath, state, "utf8");
-  } catch {
-    // best-effort; env var can still override at runtime
-  }
-}
-
-export function parseXpModeArg(args: string, current: XpMode): XpMode {
-  const arg = (args ?? "").trim().toLowerCase();
-  if (arg === "swarm") return "swarm";
-  if (arg === "on") return "swarm";
-  if (arg === "off") return "off";
-  if (arg === "lite") return "lite";
-  // Bare /xp is the low-ceremony path: toggle the default XP workflow on/off.
-  return current === "off" ? "swarm" : "off";
-}
-
 // ── Main extension ────────────────────────────────────────────────────
 
 export default function casefileExtension(pi: ExtensionAPI) {
@@ -797,7 +781,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
   // already-loaded extension or reveal a tool that was omitted at startup.
   const startedAsSubagent = process.env.PI_SUBAGENT_CHILD === "1";
   const isSubagentProcess = () => startedAsSubagent || process.env.PI_SUBAGENT_CHILD === "1";
-  // Pin the workspace root ONCE at extension load. Every scratchpad / pipeline
+  // Pin the workspace root ONCE at extension load. Every scratchpad
   // / PoC-path lookup otherwise re-walks the ambient cwd on each call — a
   // mid-session `cd` would split state across two .scratchpad roots and
   // misroot the hunt file-existence filter. The PoC runner reads PI_POC_ROOT
@@ -845,6 +829,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
     promptGuidelines: [
       "Use CaseAdd for a new security lead. New cases start as status='hypothesis' or 'investigating' — promote later with CaseUpdate.",
       "disproveIf is REQUIRED on CaseAdd: name the falsification conditions (what would disprove this hypothesis). A hypothesis that can't say what kills it isn't a hypothesis yet.",
+      "Declare the invariant: the security rule the finding would violate (e.g. 'a user cannot read another user's orders'). Confirmation checks the invariant is actually broken, not just that a request succeeded — a reproduction without a violated invariant is a mechanism, not a vulnerability.",
       "Check the injected case list or CaseList/CaseSearch first. Do not add a duplicate for the same title/scope.",
       "CaseAdd rejects exact and NEAR-duplicates (same target + overlapping title, e.g. parallel-subagent re-phrasings). A near-duplicate result → continue the existing case ID via CaseUpdate, don't create a new one.",
       "confirmed/reported only via their gates: proof in poc + PromoteFinding for confirmed; CaseContext + report for reported.",
@@ -853,7 +838,13 @@ export default function casefileExtension(pi: ExtensionAPI) {
     parameters: AddSchema,
 
     async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const result = addCaseResult(params as CaseInput);
+      const { retry_policy, ...rest } = params as Record<string, unknown>;
+      const result = addCaseResult({
+        ...(rest as CaseInput),
+        ...(retry_policy !== undefined
+          ? { retryPolicy: retry_policy as CaseInput["retryPolicy"] }
+          : {}),
+      });
       const record = result.record;
       return {
         content: [
@@ -905,8 +896,14 @@ export default function casefileExtension(pi: ExtensionAPI) {
     parameters: UpdateSchema,
 
     async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const { id, ...update } = params;
-      const result = updateCaseResult(id as string, update as CaseUpdate);
+      const { id, retry_policy, ...rest } = params as Record<string, unknown>;
+      const update = {
+        ...(rest as CaseUpdate),
+        ...(retry_policy !== undefined
+          ? { retryPolicy: retry_policy as CaseUpdate["retryPolicy"] }
+          : {}),
+      };
+      const result = updateCaseResult(id as string, update);
       const record = result.record;
       return {
         content: [
@@ -971,7 +968,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
         content: [
           {
             type: "text",
-            text: `Evidence item recorded:\n[${item.role}] ${item.summary}${item.artifactPath ? ` — ${item.artifactPath} sha256:${item.sha256?.slice(0, 12)}…` : ""}\n\n${formatCaseDetail(record)}`,
+            text: `Evidence item recorded:\n[${item.role}] ${item.summary}${item.artifactPath ? ` — ${item.artifactPath} sha256:${item.sha256?.slice(0, 12)}…` : ""}${item.containsSecret ? `\n⚠ Artifact contains suspected secrets (${item.secretFindings?.join(", ")}) — stored and hashed, but REDACT these values in any export or report.` : ""}\n\n${formatCaseDetail(record)}`,
           },
         ],
         details: { item, record },
@@ -1001,158 +998,6 @@ export default function casefileExtension(pi: ExtensionAPI) {
     },
   });
 
-  // ── Tool: CoverageAdd ──
-
-  const CoverageAddSchema = Type.Object(
-    {
-      case_id: Type.String({
-        description: "Case ID (the pipeline-run or finding case) to record coverage under",
-      }),
-      asset: Type.String({
-        description:
-          "The asset tested — copy it verbatim from the case target where shown. For scope=wide use the deployment-wide identifier.",
-      }),
-      class: Type.String({
-        description:
-          "The attack class tested (e.g. sql-injection, xss, idor, ssti, ssrf, auth-bypass, ...).",
-      }),
-      // Provider-safe string enum (per the header rule): Type.Union(Type.Literal)
-      // serializes to anyOf/const, which some providers drop — scope would
-      // arrive undefined and every explicit 'wide' verdict would silently
-      // persist as 'local', under-reporting tested classes.
-      scope: Type.String({
-        enum: [...COVERAGE_SCOPE_VALUES],
-        description:
-          "'wide' if the verdict applies to the whole deployment/account/host (recorded ONCE, applies to every asset of the deployment — do NOT re-test it per asset); 'local' if specific to this one asset.",
-      }),
-      note: Type.String({
-        description:
-          "Short note of the tests ACTUALLY RUN and the verdict: techniques tried · result · key gap. A verdict guessed without testing can hide a real issue.",
-      }),
-      evidence_item_id: Type.Optional(
-        Type.String({
-          description:
-            "Evidence item id backing this tested verdict (must be an artifact-backed EvidenceAdd item on this case). Cells without a backing item render as 'unbacked' in CoverageReport — 'tested' claims must be machine-checkable, not prose-only.",
-        }),
-      ),
-    },
-    { additionalProperties: false },
-  );
-
-  registerCaseTool({
-    name: "CoverageAdd",
-    label: "Record Coverage",
-    description:
-      "Record what you tested so it is not re-tested. Call AFTER finishing a CLASS of issue, for BOTH outcomes (found or clean — a clean result is just as important to record). scope=wide: the verdict is a property of the whole deployment, recorded once and applied to every later asset (do NOT re-test per asset); scope=local: specific to this one asset. The cell's existence marks that class tested for that asset.",
-    promptSnippet: "Record a tested attack class (coverage)",
-    promptGuidelines: [
-      "Record a coverage cell after you finish testing a class on an asset — found OR clean. Clean results are what make 'every class is COVERED' machine-checkable.",
-      "scope=wide for deployment-wide verdicts (record once, applies to every asset of the deployment — do NOT re-test it per asset). scope=local for single-asset verdicts.",
-      "The note must describe tests you ACTUALLY RAN, not assumptions. A verdict guessed without testing can hide a real issue.",
-      "Coverage cells live on the pipeline-run case (or the target's main case); CoverageReport shows the matrix.",
-    ],
-    parameters: CoverageAddSchema,
-
-    async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const item = recordCoverageResult(params.case_id as string, {
-        asset: params.asset as string,
-        class: params.class as string,
-        scope: (params.scope ?? "local") as CoverageScope,
-        note: params.note as string,
-        evidenceItemId: params.evidence_item_id as string | undefined,
-      });
-      const record = getCaseById(params.case_id as string);
-      if (!record) throw new Error(`Case not found after coverage insert: ${params.case_id}`);
-      return {
-        content: [
-          {
-            type: "text",
-            text: `Coverage recorded: [${item.scope}] ${item.asset} × ${item.class} — ${item.note}\n\n${formatCaseDetail(record)}`,
-          },
-        ],
-        details: { item, record },
-      };
-    },
-
-    renderCall(args, theme) {
-      return callLine(
-        theme,
-        "CoverageAdd",
-        `${(args.asset as string) ?? ""} [${(args.class as string) ?? ""}]`,
-      );
-    },
-
-    renderResult(result, _opts, theme) {
-      const details = result.details as { item?: CoverageItem } | undefined;
-      if (!details?.item) {
-        return new Text(theme.fg("error", "✗ CoverageAdd failed"), 0, 0);
-      }
-      return new Text(
-        theme.fg("success", "✓ ") +
-          theme.fg("dim", `[${details.item.scope}] `) +
-          truncateToWidth(`${details.item.asset} × ${details.item.class}`, 50),
-        0,
-        0,
-      );
-    },
-  });
-
-  // ── Tool: CoverageReport ──
-
-  const CoverageReportSchema = Type.Object(
-    {
-      case_id: Type.String({ description: "Case ID to render the coverage matrix for" }),
-    },
-    { additionalProperties: false },
-  );
-
-  registerCaseTool({
-    name: "CoverageReport",
-    label: "Coverage Matrix",
-    description:
-      "Render the machine-checkable coverage matrix for a case: which (asset × attack-class) cells are tested, with wide-verdict propagation. Run before deciding HUNT coverage is done — the plateau stop (zero new classes testable) must be visible in the matrix, not asserted in prose.",
-    promptSnippet: "Show which attack classes were tested where",
-    promptGuidelines: [
-      "Run CoverageReport before claiming 'every class is COVERED/SKIPPED/NOT_FOUND' — the claim must match the matrix.",
-      "A class with a wide clean verdict covers every asset — do NOT re-test it per asset.",
-      "Classes tested with no cell recorded are invisible: record coverage as you finish each class (CoverageAdd).",
-    ],
-    parameters: CoverageReportSchema,
-
-    async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const summary = coverageSummary(params.case_id as string);
-      const lines: string[] = [`Coverage matrix for ${params.case_id}:`];
-      for (const asset of summary.assets) {
-        lines.push(`\n## ${asset}`);
-        for (const cell of summary.byAsset[asset] ?? []) {
-          lines.push(
-            `- [${cell.scope}] ${cell.class} — ${cell.note}${cell.testedBy ? ` (by ${cell.testedBy})` : ""}` +
-              (cell.evidenceItemId
-                ? ""
-                : " ⚠ unbacked (link an artifact-backed evidence item via CoverageAdd evidence_item_id)"),
-          );
-        }
-      }
-      if (summary.items.length === 0) {
-        lines.push("\n(no coverage recorded yet — run CoverageAdd as each class is tested)");
-      }
-      return {
-        content: [{ type: "text", text: lines.join("\n") }],
-        details: { summary },
-      };
-    },
-
-    renderCall(args, theme) {
-      return callLine(theme, "CoverageReport", (args.case_id as string) ?? "");
-    },
-
-    renderResult(result, _opts, theme) {
-      const details = result.details as { summary?: { items?: CoverageItem[] } } | undefined;
-      const n = details?.summary?.items?.length ?? 0;
-      return new Text(theme.fg("success", `✓ ${n} coverage cell(s)`), 0, 0);
-    },
-  });
-
   // ── Tool: PromoteFinding (phase 1) ──
 
   if (!startedAsSubagent)
@@ -1169,8 +1014,9 @@ export default function casefileExtension(pi: ExtensionAPI) {
         "The PoC MUST write evidence.json to $PI_POC_EVIDENCE_DIR: { nonce (echo $PI_POC_NONCE), claim, verify: { method, url, expect: { status?, body_contains/body_regex } }, observations }. A non-empty body predicate is mandatory; status-only evidence is rejected. verify.url must belong to the case target.",
         "For reflection-capable requests, place {{PI_POC_CANARY}} exactly once in verify.url/body/header values and declare verify.canary={mode:'reflection',placeholder:'{{PI_POC_CANARY}}'}. The harness substitutes an unpredictable value only after the PoC exits and requires target-only reflection; the raw token is not persisted.",
         "control_path is optional and defaults to poc_path; if supplied, it must be the SAME script as poc_path. control_target must be pre-approved by the operator in PI_POC_CONTROL_TARGETS. The harness derives the control request from the target request, changes only its origin, and applies the same predicates to two conclusive responses.",
+        "oob=true unlocks blind/OOB classes (SSRF, blind XSS, XXE): the harness provisions per-run callback tokens via the operator's oracle (PI_OOB_ORACLE_URL), injects PI_POC_CALLBACK_DOMAIN into the runs, and polls the oracle itself — target-token interactions with ZERO control-token interactions are required. Promotion additionally requires attested source separation (PI_OOB_SOURCE_SEPARATED=1); without it the verification stays diagnostic.",
         "local:true requires PI_POC_ALLOW_NETWORK=1. Private/internal harness replay additionally requires PI_POC_ALLOW_PRIVATE_REPLAY=1. Neither silently falls back to a model verdict.",
-        "Blind/OOB classes are not promotable through the built-in loopback listener because the PoC can self-call it; obtain a direct-response or state oracle, otherwise keep the case investigating.",
+        "Blind/OOB classes fail closed unless the operator configured an OOB oracle; self-interactions (PI_OOB_SELF_IPS) are rejected and never counted as target hits.",
         "After the bundle is recorded, stay in the main agent: inspect the script/evidence, attempt disconfirmation, and call ConfirmFinding itself; that call performs a fresh harness-owned target/control replay. Never delegate validation/confirmation and never CaseUpdate status='confirmed' directly.",
       ],
       parameters: PromoteSchema,
@@ -1188,7 +1034,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
         const caseId = params.id as string;
         const current = assertPromotable(caseId);
 
-        const fail = (text: string, _extra?: Record<string, unknown>): never => {
+        const fail = (text: string): never => {
           throw new Error(text);
         };
 
@@ -1199,40 +1045,75 @@ export default function casefileExtension(pi: ExtensionAPI) {
           (params.mode as string | undefined) === "intra_target" ? "intra_target" : "inter_host";
         const isIntra = mode === "intra_target";
         if (!pocPath) {
-          return fail("poc_path is REQUIRED: absolute path to the PoC script run by the harness.", {
-            missingPocPath: true,
-          });
+          return fail("poc_path is REQUIRED: absolute path to the PoC script run by the harness.");
+        }
+        const caseTarget = current.target ?? "";
+        // Panel votes (advisory pre-gate): validated here so a malformed panel
+        // is rejected before any sandboxed run is paid for.
+        let panelVotes: PendingConfirmation["panelVotes"];
+        if (params.panel_votes !== undefined) {
+          const parsedVotes = validatePanelVotes(params.panel_votes);
+          if (!parsedVotes.ok) {
+            return fail(`Invalid panel_votes: ${parsedVotes.error}`);
+          }
+          panelVotes = parsedVotes.votes;
         }
-        // Control-target preconditions apply only to the inter-host differential.
-        // Intra-target proves target-dependence with a same-host baseline request
-        // carried in the evidence, so it needs no control target or control script.
-        if (!isIntra) {
+        // ── OOB callback (Tier 1, opt-in for blind classes) ──
+        // The operator-run oracle owns the evidence channel; the harness owns
+        // the secret (per-run token, provisioned before the runs and injected
+        // as env — the value does not exist when the script was written).
+        // Without an oracle this stays fail-closed.
+        const oobRequested = params.oob === true;
+        // Intra-target + OOB is rejected up front: intra_target's
+        // discriminating variable is identity/parameter on the SAME host;
+        // mixing it with a callback differential would make precedence
+        // ambiguous. OOB is for inter-host/blind classes.
+        if (isIntra && oobRequested) {
+          return fail(
+            "mode:'intra_target' cannot be combined with oob:true — intra-target proof uses a same-host baseline request, not a callback channel. Use one or the other.",
+          );
+        }
+        let oobConfig: OobOracleConfig | undefined;
+        let targetCallback: ProvisionedCallback | undefined;
+        let controlCallback: ProvisionedCallback | undefined;
+        if (oobRequested) {
+          const oracle = readOobOracleConfig();
+          if (!oracle.config) {
+            return fail(`OOB CONFIRMATION UNAVAILABLE: ${oracle.error}`);
+          }
+          oobConfig = oracle.config;
+          // Provision both identities concurrently — each is an oracle round trip.
+          [targetCallback, controlCallback] = await Promise.all([
+            provisionCallback(oobConfig),
+            provisionCallback(oobConfig),
+          ]);
+        }
+        // OOB-only bundles (blind classes, no operator-approved control host)
+        // prove target-dependence via the token differential instead.
+        const oobOnly = oobRequested && !controlTarget;
+        if (!isIntra && !oobOnly) {
           if (!controlTarget) {
             return fail(
-              "control_target is REQUIRED for inter-host mode: a distinct baseline target that lacks the vulnerability. For access-control/logic bugs use mode='intra_target' with an evidence baseline instead.",
-              { missingControlTarget: true },
+              "control_target is REQUIRED for inter-host mode: a distinct baseline target that lacks the vulnerability. For access-control/logic bugs use mode='intra_target' with an evidence baseline instead; for blind/OOB classes pass oob=true (with or without a control target).",
             );
           }
           if (controlTarget === current.target) {
             return fail(
               "control_target must differ from the case target; a control run against the vulnerable target proves nothing.",
-              { controlTargetEqualsCaseTarget: true },
             );
           }
         }
         if (params.local === true && process.env.PI_POC_ALLOW_NETWORK !== "1") {
           return fail(
             "Networked PoC execution is operator-gated. Set PI_POC_ALLOW_NETWORK=1 to authorize the host-network sandbox for this session.",
-            { networkNotAuthorized: true },
           );
         }
-        if (!isIntra) {
+        if (!isIntra && !oobOnly) {
           const controlAuthorization = controlTargetAuthorizationError(controlTarget);
           if (controlAuthorization) {
             return fail(
               `CONTROL AUTHORIZATION FAILED: ${controlAuthorization}. ` +
                 "The operator must set PI_POC_CONTROL_TARGETS to the exact approved control host/origin before this control can anchor confirmation.",
-              { controlNotAuthorized: true },
             );
           }
         }
@@ -1243,46 +1124,40 @@ export default function casefileExtension(pi: ExtensionAPI) {
         try {
           pocHash = createHash("sha256").update(readFileSync(pocPath)).digest("hex");
         } catch (e) {
-          return fail(`Cannot read PoC script: ${(e as Error).message}`, {
-            sameFileCheckFailed: true,
-          });
+          return fail(`Cannot read PoC script: ${(e as Error).message}`);
         }
-        if (!isIntra) {
+        if (!isIntra && !oobOnly) {
           let controlHash: string | undefined;
           try {
             controlHash = createHash("sha256").update(readFileSync(controlPath)).digest("hex");
           } catch (e) {
             return fail(
               `Cannot read control script for the same-file check: ${(e as Error).message}`,
-              { sameFileCheckFailed: true },
             );
           }
           if (pocHash !== controlHash) {
             return fail(
               "CONTROL CHECK FAILED: control_path must be the SAME script as poc_path (sha256 mismatch). Case remains investigating.",
-              { controlHashMismatch: true },
             );
           }
         }
 
-        // ── OOB callback (Tier 1, opt-in for blind classes) ──
-        const oobRequested = params.oob === true;
-        if (oobRequested) {
-          return fail(
-            "OOB confirmation is fail-closed: the built-in loopback listener is reachable by the PoC and cannot prove the target caused a callback. A source-separated, operator-owned callback service is required before blind findings can be promoted.",
-            { oobSourceSeparationRequired: true },
-          );
-        }
+        // ── OOB callback tokens were provisioned above, before the runs ──
         const runOptions = (pocMode: string, target: string): PocRunOptions => ({
           network: params.local === true ? "host" : "none",
           local: params.local === true,
           env: {
             PI_POC_MODE: pocMode,
             PI_POC_TARGET: target,
+            ...(oobRequested && targetCallback && controlCallback
+              ? {
+                  PI_POC_CALLBACK_DOMAIN:
+                    pocMode === "control" ? controlCallback.domain : targetCallback.domain,
+                }
+              : {}),
           },
         });
 
-        const caseTarget = current.target ?? "";
         // Determinism: TWO target runs. Exit 0 is run integrity only; nonce-bound
         // body evidence plus the harness-owned differential replay (inter-host
         // control, or intra-target same-host baseline) form the machine gate.
@@ -1299,7 +1174,6 @@ export default function casefileExtension(pi: ExtensionAPI) {
               `${mode} run did not complete or output capture was incomplete` +
                 (r.infraError ? ` (infra: ${r.output.trim()})` : "") +
                 ". A crash is not evidence. Case remains investigating.",
-              { run: r, pocCrashed: true },
             );
           }
           if (r.evidenceError) {
@@ -1307,13 +1181,10 @@ export default function casefileExtension(pi: ExtensionAPI) {
               `EVIDENCE CONTRACT FAILED (${mode} run): ${r.evidenceError}. ` +
                 "The PoC must write evidence.json to $PI_POC_EVIDENCE_DIR — { nonce (echo $PI_POC_NONCE), claim, verify: { method, url, expect: { status?, body_contains / body_regex } }, observations }; a response-body assertion is mandatory — " +
                 "the file is bound to this run and validated by the harness. Case remains investigating.",
-              { run: r, evidenceError: r.evidenceError },
             );
           }
           if (!r.evidence || !r.evidenceSha256 || !r.nonce) {
-            return fail(`${mode} run produced no evidence. Case remains investigating.`, {
-              run: r,
-            });
+            return fail(`${mode} run produced no evidence. Case remains investigating.`);
           }
           return {
             mode,
@@ -1336,8 +1207,17 @@ export default function casefileExtension(pi: ExtensionAPI) {
           evidenceRun(run2, "poc", caseTarget),
         ];
 
+        // Reflection canary + OOB is rejected after run 1 (the canary is
+        // declared inside evidence.json): the canary path requires a harness
+        // response transcript, which OOB-only bundles never produce — the
+        // per-run callback token IS the causality signal there.
+        if (oobRequested && targetRuns.some((r) => r.evidence.verify.canary !== undefined)) {
+          return fail(
+            "verify.canary cannot be combined with oob:true — the per-run callback token already provides a harness-owned causality signal. Remove the {{PI_POC_CANARY}} placeholder and verify.canary from evidence.json, then re-promote.",
+          );
+        }
         const allowPrivateReplay = process.env.PI_POC_ALLOW_PRIVATE_REPLAY === "1";
-        let harnessVerified: HarnessVerifyResult;
+        let harnessVerified: HarnessVerifyResult | undefined;
         let controlRun: PocEvidenceRun | undefined;
         if (isIntra) {
           // Intra-target: prove target-dependence with the evidence's same-host
@@ -1347,19 +1227,17 @@ export default function casefileExtension(pi: ExtensionAPI) {
           if (ev0.verify.mode !== "intra_target") {
             return fail(
               "INTRA-TARGET FAILED: the PoC's evidence.json must set verify.mode='intra_target' when promoting in intra-target mode.",
-              { intraModeMismatch: true },
             );
           }
           if (!ev0.baseline) {
             return fail(
               "INTRA-TARGET FAILED: evidence.json must include a baseline — a legitimate same-host request whose response must NOT satisfy the attack predicate.",
-              { intraBaselineMissing: true },
             );
           }
           harnessVerified = await replayIntraTarget(ev0, caseTarget, {
             allowPrivate: allowPrivateReplay,
           });
-        } else {
+        } else if (!oobOnly) {
           // Inter-host (Tier 2): the harness executes the SAME request template
           // against target and operator-approved control, applying the target's
           // predicates to both. DNS is pinned at connect time.
@@ -1375,6 +1253,20 @@ export default function casefileExtension(pi: ExtensionAPI) {
             { allowPrivate: allowPrivateReplay },
           );
         }
+        // OOB differential: poll the oracle for both run tokens. The ledger's
+        // assertMachineConfirmation consumes this BEFORE the response-diff
+        // requirement — blind classes pass via this path when the oracle saw
+        // the target token and NOT the control token under attested source
+        // separation.
+        let callbackVerified: OobVerification | undefined;
+        if (oobConfig && targetCallback && controlCallback) {
+          callbackVerified = (
+            await verifyOobDifferential({
+              targetToken: targetCallback.token,
+              controlToken: controlCallback.token,
+            })
+          ).verification;
+        }
         const bundle: PendingConfirmation = {
           caseId,
           ranAt: new Date().toISOString(),
@@ -1383,16 +1275,24 @@ export default function casefileExtension(pi: ExtensionAPI) {
           mode,
           targetRuns,
           harnessVerified,
-          ...(isIntra ? {} : { controlPath, controlTarget, controlRun }),
+          ...(panelVotes ? { panelVotes } : {}),
+          ...(callbackVerified && targetCallback && controlCallback
+            ? {
+                callbackVerified,
+                oobTokens: {
+                  targetToken: targetCallback.token,
+                  controlToken: controlCallback.token,
+                },
+              }
+            : {}),
+          ...(!(isIntra || oobOnly) ? { controlPath, controlTarget, controlRun } : {}),
         };
 
         let record: CaseRecord;
         try {
           record = storePendingConfirmation(caseId, bundle);
         } catch (e) {
-          return fail(`Pending confirmation rejected: ${(e as Error).message}`, {
-            storeRejected: true,
-          });
+          return fail(`Pending confirmation rejected: ${(e as Error).message}`);
         }
 
         return {
@@ -1404,7 +1304,11 @@ export default function casefileExtension(pi: ExtensionAPI) {
                 `Mode: ${mode}. ${isIntra ? "Target runs: 2, same-host baseline differential" : "Target runs: 2, Control run: 1"} — all with validated nonce-bound evidence.json.\n` +
                 `Evidence sha256: ${targetRuns[0].evidenceSha256}\n` +
                 `PoC script sha256 (at run time): ${pocHash}\n` +
-                `Harness verify replay: ${harnessVerified.attempted ? (harnessVerified.pass ? `PASS (status ${harnessVerified.status})` : `FAILED — ${harnessVerified.note}`) : harnessVerified.note}\n` +
+                `Harness verify replay: ${harnessVerified?.attempted ? (harnessVerified.pass ? `PASS (status ${harnessVerified.status})` : `FAILED — ${harnessVerified.note}`) : (harnessVerified?.note ?? "not run")}
+` +
+                (callbackVerified
+                  ? `OOB oracle: target-token hits ${callbackVerified.targetHits}, control-token hits ${callbackVerified.controlHits}, source-separated: ${String(callbackVerified.sourceSeparated)} — ${callbackVerified.note}\n`
+                  : "") +
                 `\nMAIN-AGENT REVIEW REQUIRED (do not delegate): inspect case ${caseId}, PoC ${pocPath}, ${isIntra ? "same-host baseline" : `control ${controlTarget}`}, evidence ${targetRuns[0].evidenceSha256}, and PoC hash ${pocHash}. Hunt for a trivial predicate or fabricated differential and perform a concrete disconfirmation attempt, then call ConfirmFinding yourself. A CONFIRMED call performs and stores a fresh harness-owned ${isIntra ? "attack/baseline" : "target/control"} replay; NOT_CONFIRMED keeps the case investigating.`,
             },
           ],
@@ -1454,15 +1358,18 @@ export default function casefileExtension(pi: ExtensionAPI) {
       name: "ConfirmFinding",
       label: "Main-Agent Confirmation",
       description:
-        "Phase 2 of confirmation, reserved for the main/coordinator agent: commit or refuse promotion after personally reviewing the machine bundle. On CONFIRMED, this tool performs a fresh harness-owned target/control replay; the verdict requires a target-only differential, a concrete re_execution_note and disconfirmation_attempt, a canary assessment, and the still-valid PromoteFinding bundle. The machine transcript is evidence, not the semantic vulnerability verdict. Worker/subagent processes are rejected. NOT_CONFIRMED records the review and keeps the case investigating.",
-      promptSnippet: "Main agent: independently review and commit or refuse PoC confirmation",
+        "Phase 2 of confirmation, reserved for the main/coordinator agent: commit or refuse promotion after independently re-testing the finding. On CONFIRMED, this tool performs a fresh harness-owned target/control replay; the verdict requires a target-only differential, a concrete re_execution_note and disconfirmation_attempt, a canary assessment, and the still-valid PromoteFinding bundle. The machine transcript is evidence, not the semantic vulnerability verdict. Worker/subagent processes are rejected. Three verdicts: CONFIRMED (you reproduced real impact), NOT_CONFIRMED (you POSITIVELY disproved it), INCONCLUSIVE (you could neither reproduce nor disprove — the case is preserved for manual review, never dropped).",
+      promptSnippet: "Main agent: independently re-test, then commit or refuse PoC confirmation",
       promptGuidelines: [
         "Run only in the main/coordinator agent after PromoteFinding returns. Do not dispatch a worker to decide or author this verdict.",
-        "Personally inspect the PoC and preserved evidence and try a concrete disconfirmation before deciding. ConfirmFinding itself re-sends the immutable verify request against target and operator-approved control so phase 2 has a harness-owned transcript.",
-        "CONFIRMED requires differential: 'target_only', re_execution_note, and disconfirmation_attempt (the main agent's failed disproof). A verdict missing any of these is rejected.",
-        "Set canary_assessment='verified' when the immutable request declared a canary; otherwise set not_applicable and explain why a reflection canary is not meaningful for this exploit class.",
-        "NOT_CONFIRMED is final for that attempt — the case stays investigating with the main agent's reasoning recorded. A fresh PromoteFinding run is required for another attempt.",
-        "Never CaseUpdate status='confirmed' directly — it is rejected. Always use PromoteFinding + ConfirmFinding.",
+        "Verify with DISBELIEF: assume the finding is a false positive until your OWN re-test proves otherwise. Reproduce the exact observable yourself from the primary evidence (not the hunter's narrative), with a negative/baseline control — a difference you cannot tie to the control is not proof. ConfirmFinding itself re-sends the immutable verify request against target and operator-approved control so phase 2 has a harness-owned transcript.",
+        "Provenance: the proof must exercise THIS finding's own mechanism. Evidence obtained through a DIFFERENT bug (e.g. 'SQLi' proven by dumping the DB via an RCE) does not confirm it — that is INCONCLUSIVE at best.",
+        "Kill the cheapest benign explanation: is this the technology's intended behavior? Did the attacker supply the 'secret' themselves (circular)? Is the claimed C/I/A impact actually demonstrated?",
+        "Want a second pair of eyes? Dispatch a read-only skeptic subagent to re-test — it CANNOT confirm (only the main agent commits). You review its verdict and commit it here.",
+        "CONFIRMED requires differential: 'target_only', re_execution_note, and disconfirmation_attempt (your failed disproof). A verdict missing any of these is rejected. Set canary_assessment='verified' when the immutable request declared a canary; otherwise not_applicable with a reason.",
+        "NOT_CONFIRMED means you POSITIVELY disproved it (by-design, circular, mislabeled, no impact). Never mark NOT_CONFIRMED merely because you could not reproduce it.",
+        "INCONCLUSIVE when you could neither reproduce nor disprove (needs auth, a second account, specific state, timing, or a blind/stored trigger you cannot observe). The case stays investigating and is preserved for manual review — dropping a real finding is worse than keeping an unproven one.",
+        "Every verdict consumes the attempt: a fresh PromoteFinding run is required to try again. Never CaseUpdate status='confirmed' directly — always PromoteFinding + ConfirmFinding.",
       ],
       parameters: ConfirmSchema,
 
@@ -1493,6 +1400,46 @@ export default function casefileExtension(pi: ExtensionAPI) {
             replay = await replayIntraTarget(bundle.targetRuns[0].evidence, caseTargetForReplay, {
               allowPrivate,
             });
+          } else if (bundle.callbackVerified?.attempted && bundle.oobTokens) {
+            // OOB differential: fresh harness-owned re-poll of BOTH run tokens.
+            // Re-polling at confirm time catches interactions that landed after
+            // phase 1 (e.g. a delayed control-token hit) — the verdict is bound
+            // to this fresh observation, not the stored one.
+            const { verification } = await verifyOobDifferential({
+              targetToken: bundle.oobTokens.targetToken,
+              controlToken: bundle.oobTokens.controlToken,
+            });
+            const oobPass =
+              verification.targetHits > 0 &&
+              verification.controlHits === 0 &&
+              verification.sourceSeparated === true;
+            replay = {
+              attempted: true,
+              pass: oobPass,
+              target: {
+                attempted: true,
+                matched: verification.targetHits > 0,
+                url: bundle.targetRuns[0].evidence.verify.url,
+                note: verification.note,
+              },
+              control: {
+                attempted: true,
+                matched: verification.controlHits > 0,
+                url: bundle.targetRuns[0].evidence.verify.url,
+                note: `${verification.controlHits} control-token interaction(s)`,
+              },
+              differential:
+                verification.targetHits > 0
+                  ? verification.controlHits === 0
+                    ? "target_only"
+                    : "both"
+                  : "neither",
+              note: `harness OOB re-poll: ${verification.note}`,
+            };
+          } else if (bundle.callbackVerified?.attempted) {
+            throw new Error(
+              "OOB bundle lacks its provisioned tokens (pre-token-storage ledger) — re-run PromoteFinding for a fresh bundle",
+            );
           } else {
             if (!bundle.controlTarget) {
               throw new Error("inter-host confirmation requires a control target");
@@ -1525,7 +1472,10 @@ export default function casefileExtension(pi: ExtensionAPI) {
               text: promoted
                 ? `Main agent CONFIRMED. Case promoted:
 ${formatCaseDetail(record)}`
-                : `Main agent NOT_CONFIRMED — case stays investigating (attempt recorded):
+                : parsedVerdict.verdict.verdict === "INCONCLUSIVE"
+                  ? `Main agent INCONCLUSIVE — case stays investigating, preserved for manual review (not disproved):
+${formatCaseDetail(record)}`
+                  : `Main agent NOT_CONFIRMED — case stays investigating (attempt recorded):
 ${formatCaseDetail(record)}`,
             },
           ],
@@ -1549,6 +1499,65 @@ ${formatCaseDetail(record)}`,
       },
     });
 
+  // ── Tool: CoverageAdd ──
+
+  registerCaseTool({
+    name: "CoverageAdd",
+    label: "Record Coverage Cell",
+    description:
+      "Record a tested (asset × attack-class) coverage cell on a case — for BOTH outcomes (found or clean). Clean results make 'every class is covered' machine-checkable. scope='wide' records a deployment-wide verdict ONCE (do not re-test per asset); 'local' is asset-specific. Cells can carry an artifact-backed evidence item; unbacked cells render as such in the report contract gate.",
+    promptSnippet: "Record a tested coverage cell (found or clean)",
+    promptGuidelines: [
+      "Use CoverageAdd whenever you finish testing a class on an asset — a clean 'no injection on /api/orders' verdict is just as load-bearing as a finding.",
+      "scope='wide' when the verdict is a property of the whole deployment (record once — do NOT re-test per asset); scope='local' for one asset.",
+      "Reference an artifact-backed EvidenceAdd item via evidence_item_id so the tested verdict is machine-checkable, not prose-only.",
+    ],
+    parameters: CoverageAddSchema,
+
+    async execute(_id, params, _signal, _onUpdate, _ctx) {
+      const item = recordCoverageResult(params.case_id as string, {
+        asset: params.asset as string,
+        class: params.class as string,
+        scope: params.scope as CoverageScope,
+        note: params.note as string,
+        evidenceItemId: params.evidence_item_id as string | undefined,
+      });
+      const record = getCaseById(params.case_id as string);
+      if (!record) throw new Error(`Case not found after coverage insert: ${params.case_id}`);
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Coverage cell recorded:\n[${item.scope}] ${item.asset} × ${item.class} — ${item.note}${item.evidenceItemId ? ` (backed by ${item.evidenceItemId})` : " (unbacked — attach an EvidenceAdd item to make it machine-checkable)"}\n\n${formatCaseDetail(record)}`,
+          },
+        ],
+        details: { item, record },
+      };
+    },
+
+    renderCall(args, theme) {
+      return callLine(
+        theme,
+        "CoverageAdd",
+        `${(args.case_id as string) ?? ""} ${(args.asset as string) ?? ""}×${(args.class as string) ?? ""}`,
+      );
+    },
+
+    renderResult(result, _opts, theme) {
+      const details = result.details as { item?: CoverageItem } | undefined;
+      if (!details?.item) {
+        return new Text(theme.fg("error", "✗ CoverageAdd failed"), 0, 0);
+      }
+      return new Text(
+        theme.fg("success", "✓ ") +
+          theme.fg("dim", `[${details.item.scope}] `) +
+          truncateToWidth(`${details.item.asset} × ${details.item.class}`, 60),
+        0,
+        0,
+      );
+    },
+  });
+
   // ── Tool: CaseGet ──
 
   registerCaseTool({
@@ -1763,67 +1772,6 @@ ${formatCaseDetail(record)}`,
     },
   });
 
-  // ── Tool: ChainSuggest ──
-
-  const ChainSuggestSchema = Type.Object(
-    {
-      case_id: Type.Optional(
-        Type.String({
-          description:
-            "Optional: scope suggestions to this case and its linked cases. Omit to scan all non-terminal cases.",
-        }),
-      ),
-    },
-    { additionalProperties: false },
-  );
-
-  registerCaseTool({
-    name: "ChainSuggest",
-    label: "Suggest Exploit Chains",
-    description:
-      "Scan non-terminal cases for exploitable chains (credential+endpoint→ATO, open-redirect+OAuth→token theft, XSS+state-changing→CSRF bypass, IDOR+user-data→mass leak, SSTI→RCE, race+payment→financial, info-disclosure+SSRF). Returns ranked candidates with confidence and a suggested link kind — the agent decides whether to CaseLink them or open an escalation case. Catches chain combinations the model may have missed.",
-    promptSnippet: "Find missed exploit-chain combinations",
-    promptGuidelines: [
-      "Run ChainSuggest before concluding an engagement — low-severity findings that chain into high-impact (ATO, token theft, mass leak) are the ones triage cares about.",
-      "A suggestion is a HYPOTHESIS to verify, not a finding: test the chained behavior on the live target before linking or promoting anything.",
-      "Chain a suggested pair with CaseLink (suggested kind) or open a new escalation case with status=hypothesis.",
-    ],
-    parameters: ChainSuggestSchema,
-
-    async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const suggestions = await suggestChainsAsync(
-        (params.case_id as string | undefined) ?? undefined,
-      );
-      const lines: string[] = [
-        suggestions.length
-          ? `${suggestions.length} chain candidate(s):`
-          : "No chain candidates found across non-terminal cases.",
-      ];
-      for (const s of suggestions) {
-        const pair = s.targetId
-          ? `${s.sourceId} (${s.sourceTitle}) + ${s.targetId} (${s.targetTitle ?? ""})`
-          : `${s.sourceId} (${s.sourceTitle})`;
-        lines.push(
-          `\n[${s.pattern}] conf ${s.confidence}% — ${pair}\n  ${s.rationale}${s.suggestedKind ? `\n  suggested link kind: ${s.suggestedKind}` : ""}`,
-        );
-      }
-      return {
-        content: [{ type: "text", text: lines.join("\n") }],
-        details: { suggestions },
-      };
-    },
-
-    renderCall(args, theme) {
-      return callLine(theme, "ChainSuggest", (args.case_id as string) ?? "all");
-    },
-
-    renderResult(result, _opts, theme) {
-      const details = result.details as { suggestions?: { length: number } } | undefined;
-      const n = details?.suggestions?.length ?? 0;
-      return new Text(theme.fg(n ? "accent" : "dim", `${n} chain candidate(s)`), 0, 0);
-    },
-  });
-
   // ── Tool: CaseContext ──
 
   registerCaseTool({
@@ -1839,15 +1787,15 @@ ${formatCaseDetail(record)}`,
     parameters: IdSchema,
 
     async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const { path, contextPath, record } = await writeCaseContextAsync(params.id as string);
+      const { path, contextPath, contractPath, record } = writeCaseContext(params.id as string);
       return {
         content: [
           {
             type: "text",
-            text: `Case context written: ${contextPath}\nReport path: ${path}\n${formatCase(record)}`,
+            text: `Case context written: ${contextPath}\nReport path: ${path}\nReport contract path: ${contractPath} — write the closed-schema JSON contract there (evidence_ids + coverage_refs must reference only this case's items); status='reported' is rejected until it validates.\n${formatCase(record)}`,
           },
         ],
-        details: { path, contextPath, record },
+        details: { path, contextPath, contractPath, record },
       };
     },
 
@@ -1865,244 +1813,6 @@ ${formatCaseDetail(record)}`,
     },
   });
 
-  // ── Command: /xp (toggle offensive XP mode) ──
-
-  pi.registerCommand("xp", {
-    description:
-      "Toggle casefile XP (offensive) mode. Bare /xp and /xp on select SWARM, the bounded multi-agent workflow. LITE keeps XP single-agent. OFF (default) keeps context quiet for normal dev work. Usage: /xp [on|lite|swarm|off]",
-    handler: async (args, ctx) => {
-      const next = parseXpModeArg(args ?? "", readXpMode());
-      writeXpMode(next);
-      // Re-enabling after a mid-session /xp off must re-inject the workflow
-      // on the next prompt — otherwise workflowInjected (module-level, set on
-      // first enable) stays true and the workflow never comes back until the
-      // process restarts.
-      if (next !== "off") workflowInjected = false;
-      ctx.ui.notify(
-        `Casefile XP mode: ${next.toUpperCase()} (takes effect on the next prompt)`,
-        next === "off" ? "warning" : "info",
-      );
-    },
-  });
-
-  // ── Tool: PipelineSubmit ──
-
-  registerCaseTool({
-    name: "PipelineSubmit",
-    label: "Submit Stage Output",
-    description:
-      "Submit a pipeline stage's output (hunt, trace, skeptic, validate, chain, report) through the validation gate. Validates required fields against the stage spec (mirrors schemas/*.json), applies the deterministic pre-filter (test-path and file-existence filters on hunt findings, trivial dedup by file+class+line), and counts repair attempts (max 2, then rejected). A stage cannot advance on an invalid output — submit fixed output until accepted.",
-    promptSnippet: "Validate and submit a pipeline stage's output",
-    promptGuidelines: [
-      "Every delegated stage output and every main-agent VALIDATE/REPORT output must go through PipelineSubmit before the next stage starts — do not eyeball schemas.",
-      "verdict repair → fix the listed fields and re-submit the same output; budget is 2 attempts per finding, then rejected.",
-      "Skeptic: unparseable/schema-invalid = no verdict (repair/re-dispatch); only schema-valid DISPROVEN kills, and schema-valid UNDETERMINED blocks validation.",
-      "Tracer crash/invalid output = no trace verdict; repair or re-dispatch.",
-      'Only schema-valid trace_result: "UNREACHABLE" blocks advancement as a proven unreachable path; schema-valid UNDETERMINED blocks validation until resolved.',
-      "Test-path findings and hallucinated files are rejected by the pre-filter, not repairable — the finding itself is noise.",
-    ],
-    parameters: Type.Object(
-      {
-        run_id: Type.String({
-          description: "Pipeline run identifier (same as the scratchpad run_id)",
-        }),
-        stage: Type.String({
-          enum: [...SUBMIT_STAGES],
-          description: "Pipeline stage: hunt | trace | skeptic | validate | chain | report",
-        }),
-        output: Type.Union([Type.String(), Type.Object({}, { additionalProperties: true })], {
-          description: "The stage output as a JSON object or JSON string (code fences tolerated)",
-        }),
-      },
-      { additionalProperties: false },
-    ),
-
-    async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const result = pipeline_submit(
-        params.run_id as string,
-        params.stage as SubmitStage,
-        params.output,
-      );
-      const statusLine =
-        result.verdict === "accepted"
-          ? `ACCEPTED (${params.stage}) — artifact: ${result.artifact}`
-          : result.verdict === "repair"
-            ? `REPAIR (attempt ${result.repair_attempt}/2) — fix these and re-submit:\n  - ${result.errors.join("\n  - ")}`
-            : `REJECTED — ${result.errors.join("\n")}`;
-      if (result.verdict !== "accepted") throw new Error(statusLine);
-      return {
-        content: [{ type: "text", text: statusLine }],
-        details: result as unknown as Record<string, unknown>,
-      };
-    },
-
-    renderCall(args, theme) {
-      return callLine(theme, "PipelineSubmit", `${args.stage ?? ""}`);
-    },
-
-    renderResult(result, _opts, theme) {
-      const details = result.details as { verdict?: string; repair_attempt?: number } | undefined;
-      if (details?.verdict === "accepted") {
-        return new Text(theme.fg("success", "✓ PipelineSubmit accepted"), 0, 0);
-      }
-      if (details?.verdict === "repair") {
-        return new Text(
-          theme.fg("warning", `↷ PipelineSubmit repair ${details.repair_attempt}/2`),
-          0,
-          0,
-        );
-      }
-      return new Text(theme.fg("error", "✗ PipelineSubmit rejected"), 0, 0);
-    },
-  });
-
-  // ── Tool: ScratchpadInit ──
-
-  registerCaseTool({
-    name: "ScratchpadInit",
-    label: "Init Scratchpad",
-    description:
-      "Initialize a crash-recoverable artifact store for a pipeline run. Creates the directory structure and an initial state.json checkpoint. Idempotent — safe to call on resume without --fresh; returns the existing checkpoint if the run already exists.",
-    promptSnippet: "Initialize the pipeline artifact store for a run",
-    promptGuidelines: [
-      "Call ScratchpadInit once at the start of a pipeline run (or on resume before ScratchpadResume).",
-      "The run_id is arbitrary but should be unique per pipeline run — typically <target>-<timestamp>.",
-      "On resume, ScratchpadInit returns the existing checkpoint without wiping it; pair with ScratchpadResume to skip completed phases.",
-    ],
-    parameters: RunIdSchema,
-
-    async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const cp = scratchpad_init(params.run_id as string);
-      return {
-        content: [
-          {
-            type: "text",
-            text: `Scratchpad initialized for run ${cp.run_id}.\nCompleted phases: ${cp.completed_phases.length ? cp.completed_phases.join(", ") : "none"}`,
-          },
-        ],
-        details: { checkpoint: cp },
-      };
-    },
-
-    renderCall(args, theme) {
-      return callLine(theme, "ScratchpadInit", (args.run_id as string) ?? "");
-    },
-
-    renderResult(result, _opts, theme) {
-      const cp = (result.details as { checkpoint: { run_id: string } } | undefined)?.checkpoint;
-      return new Text(`${theme.fg("success", "✓ ")}ScratchpadInit ${cp?.run_id ?? ""}`, 0, 0);
-    },
-  });
-
-  // ── Tool: ScratchpadResume ──
-
-  registerCaseTool({
-    name: "ScratchpadResume",
-    label: "Resume Scratchpad",
-    description:
-      "Read the checkpoint and artifact listing for a pipeline run to decide where to resume. Returns the next phase to run (or null if done) and which phases already completed. Returns null if the run does not exist.",
-    promptSnippet: "Check pipeline resume state — which phases are done",
-    promptGuidelines: [
-      "Call ScratchpadResume at pipeline start to determine where to resume. If it returns a checkpoint, skip completed phases (check ScratchpadPhaseDone before each dispatch) and continue from next_phase.",
-      "If ScratchpadResume returns null, the run has no checkpoint — call ScratchpadInit to start fresh.",
-      "Use ScratchpadPhaseDone before dispatching each stage to avoid re-running completed phases (idempotent resume).",
-    ],
-    parameters: RunIdSchema,
-
-    async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const resume = scratchpad_resume(params.run_id as string);
-      if (!resume) {
-        return {
-          content: [
-            {
-              type: "text",
-              text: `No scratchpad found for run ${params.run_id}. Call ScratchpadInit to start a new run.`,
-            },
-          ],
-          details: { resume: null },
-        };
-      }
-      const cp = resume.checkpoint;
-      return {
-        content: [
-          {
-            type: "text",
-            text:
-              `Resume run ${cp.run_id}:\n` +
-              `Completed phases: ${cp.completed_phases.length ? cp.completed_phases.join(", ") : "none"}\n` +
-              `Next phase: ${resume.next_phase ?? "none (run is done)"}`,
-          },
-        ],
-        details: { resume },
-      };
-    },
-
-    renderCall(args, theme) {
-      return callLine(theme, "ScratchpadResume", (args.run_id as string) ?? "");
-    },
-
-    renderResult(result, _opts, theme) {
-      const resume = (result.details as { resume: ScratchpadResume | null } | undefined)?.resume;
-      if (!resume) return new Text(theme.fg("warning", "↷ ScratchpadResume — no run found"), 0, 0);
-      return new Text(
-        theme.fg("success", "✓ ") +
-          `ScratchpadResume ${resume.checkpoint.run_id} → next: ${resume.next_phase ?? "done"}`,
-        0,
-        0,
-      );
-    },
-  });
-
-  // ── Tool: ScratchpadCheckpoint ──
-
-  registerCaseTool({
-    name: "ScratchpadCheckpoint",
-    label: "Checkpoint Phase",
-    description:
-      "Mark a pipeline phase as complete in the scratchpad state.json. Records the completion timestamp, key IDs, and an optional summary. Idempotent — re-checkpointing a phase overwrites its summary/IDs without duplicating the completed_phases entry.",
-    promptSnippet: "Record a pipeline phase as complete",
-    promptGuidelines: [
-      "Call ScratchpadCheckpoint after every phase completes: ScratchpadCheckpoint(run_id, phase, { ids, summary }).",
-      "ids are the key case/finding IDs the phase produced — used by resume to reconstruct state.",
-      "Keep completed_phases in pipeline order; the checkpoint sorts automatically.",
-    ],
-    parameters: ScratchpadCheckpointSchema,
-
-    async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const cp = scratchpad_checkpoint(params.run_id as string, params.phase as ScratchpadPhase, {
-        ids: params.ids as string[] | undefined,
-        summary: params.summary as string | undefined,
-      });
-      return {
-        content: [
-          {
-            type: "text",
-            text:
-              `Phase ${params.phase} checkpointed for run ${cp.run_id}.\n` +
-              `Completed phases: ${cp.completed_phases.join(", ")}`,
-          },
-        ],
-        details: { checkpoint: cp },
-      };
-    },
-
-    renderCall(args, theme) {
-      return callLine(theme, "ScratchpadCheckpoint", `${args.run_id ?? ""} ${args.phase ?? ""}`);
-    },
-
-    renderResult(result, _opts, theme) {
-      const cp = (
-        result.details as { checkpoint: { run_id: string; completed_phases: string[] } } | undefined
-      )?.checkpoint;
-      return new Text(
-        theme.fg("success", "✓ ") +
-          `ScratchpadCheckpoint ${cp?.run_id ?? ""} — ${cp?.completed_phases.length ?? 0} phases done`,
-        0,
-        0,
-      );
-    },
-  });
-
   // ── Tool: ScratchpadWrite ──
 
   registerCaseTool({
@@ -2110,7 +1820,7 @@ ${formatCaseDetail(record)}`,
     label: "Write Artifact",
     description:
       "Write an intermediate artifact (recon map, trace output, verification log) to a phase's subdirectory in the scratchpad. Overwrites if the name exists. Artifact names are sanitized — path traversal is blocked.",
-    promptSnippet: "Save a pipeline artifact to the scratchpad",
+    promptSnippet: "Save a run artifact to the scratchpad",
     promptGuidelines: [
       "Agents write artifacts to the scratchpad, not to each other's output files (prevents an echo chamber).",
       "The casefile owns state transitions; the scratchpad owns artifacts. Use ScratchpadWrite for bulky intermediate outputs, not CaseUpdate.",
@@ -2156,7 +1866,7 @@ ${formatCaseDetail(record)}`,
     label: "Read Artifact",
     description:
       "Read an artifact from a phase's subdirectory in the scratchpad. Returns null if the artifact is missing. Use to resume a phase from a prior run's intermediate output.",
-    promptSnippet: "Read a pipeline artifact from the scratchpad",
+    promptSnippet: "Read a run artifact from the scratchpad",
     promptGuidelines: [
       "On resume, ScratchpadRead retrieves a prior phase's intermediate output so the next phase can proceed without re-running it.",
       "Returns null for missing artifacts — treat as 'not yet produced' rather than an error.",
@@ -2206,60 +1916,16 @@ ${formatCaseDetail(record)}`,
     },
   });
 
-  // ── Tool: ScratchpadPhaseDone ──
-
-  registerCaseTool({
-    name: "ScratchpadPhaseDone",
-    label: "Phase Done?",
-    description:
-      "Check whether a phase has already been checkpointed in the scratchpad — for idempotent re-run. Returns true if the phase is complete; skip re-dispatching it on resume.",
-    promptSnippet: "Check if a pipeline phase is already complete",
-    promptGuidelines: [
-      "Call ScratchpadPhaseDone before dispatching each stage to avoid re-running completed phases on resume.",
-      "A completed phase with a checkpoint is a no-op on re-run — skip it and continue to the next incomplete phase.",
-    ],
-    parameters: ScratchpadPhaseDoneSchema,
-
-    async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const done = scratchpad_phase_done(params.run_id as string, params.phase as ScratchpadPhase);
-      return {
-        content: [
-          {
-            type: "text",
-            text: `Phase ${params.phase} for run ${params.run_id}: ${done ? "DONE (skip on resume)" : "not done"}`,
-          },
-        ],
-        details: { phase: params.phase, done },
-      };
-    },
-
-    renderCall(args, theme) {
-      return callLine(theme, "ScratchpadPhaseDone", `${args.run_id ?? ""} ${args.phase ?? ""}`);
-    },
-
-    renderResult(result, _opts, theme) {
-      const done = (result.details as { done?: boolean } | undefined)?.done;
-      return new Text(
-        done
-          ? theme.fg("success", "✓ ScratchpadPhaseDone — done")
-          : theme.fg("warning", "↷ ScratchpadPhaseDone — not done"),
-        0,
-        0,
-      );
-    },
-  });
-
   // ── Tool: ScratchpadClear ──
 
   registerCaseTool({
     name: "ScratchpadClear",
     label: "Clear Run",
     description:
-      "Clear a single pipeline run's scratchpad directory. Used by --fresh for one run. Does not touch other runs. The run must be re-initialized with ScratchpadInit afterward.",
-    promptSnippet: "Clear one pipeline run's artifacts",
+      "Clear a single run's scratchpad directory to force a fresh start for that run. Does not touch other runs. Directories are recreated automatically on the next write.",
+    promptSnippet: "Clear one run's artifacts",
     promptGuidelines: [
-      "Use ScratchpadClear to force a fresh start for a single run (--fresh). It deletes that run's directory only.",
-      "After clearing, call ScratchpadInit to recreate the directory structure before writing artifacts.",
+      "Use ScratchpadClear to force a fresh start for a single run. It deletes that run's directory only.",
     ],
     parameters: RunIdSchema,
 
@@ -2269,7 +1935,7 @@ ${formatCaseDetail(record)}`,
         content: [
           {
             type: "text",
-            text: `Scratchpad cleared for run ${params.run_id}. Call ScratchpadInit to start a new run.`,
+            text: `Scratchpad cleared for run ${params.run_id}.`,
           },
         ],
         details: { run_id: params.run_id, cleared: true },
@@ -2319,22 +1985,19 @@ ${formatCaseDetail(record)}`,
     }
   });
 
-  // ── Event: Inject cyber workflow into system prompt ──
-  // XP (offensive) mode is OFF by default so normal dev work stays quiet.
-  // When enabled, the cyber workflow is injected ONCE per session (first
-  // prompt); the active case list refreshes every prompt because it changes
-  // as cases are added. Injecting into event.systemPrompt (not as a
-  // conversation message) avoids session bloat from repeated message entries.
+  // ── Event: Inject the recon workflow + active-case list into the prompt ──
+  // The recon workflow is injected ONCE per session (first prompt); the active
+  // case list refreshes every prompt because it changes as cases are added.
+  // Injecting into event.systemPrompt (not as a conversation message) avoids
+  // session bloat from repeated message entries.
   let workflowInjected = false;
 
   pi.on("before_agent_start", async (event) => {
-    const mode = readXpMode();
-    if (mode === "off") return;
     // Skip subagent child processes: pi-subagents runs each child in its own
     // pi process (PI_SUBAGENT_CHILD=1) with this extension loaded. Injecting
     // the workflow + entire active-case ledger into every child dispatch is a
-    // token multiplier (N subagents × workflow + growing case list per turn) —
-    // workers get what they need via their task and tool guidelines.
+    // token multiplier (N children × workflow + growing case list per turn) —
+    // recon workers get what they need via their task, not the coordinator's.
     if (isSubagentProcess()) return;
 
     const includeWorkflow = !workflowInjected;
@@ -2343,15 +2006,13 @@ ${formatCaseDetail(record)}`,
     try {
       active = readActiveCases();
     } catch {
-      // No database yet — still inject workflow.
+      // No database yet — still inject the workflow.
     }
 
-    const injection = buildAgentInjection(active, includeWorkflow, mode);
+    const injection = buildAgentInjection(active, includeWorkflow);
     if (!injection) return; // workflow already injected, no active cases
     workflowInjected = true;
 
-    // Inject workflow FIRST (before skills) so the attacker mindset is
-    // prominent, not buried at the end of a long system prompt.
     return {
       systemPrompt: `${injection}\n\n${event.systemPrompt ?? ""}`,
     };